If you want to do this another way, Tailscale funnel can send public traffic into your tailnet Traefik supports pulling the Tailscale cert from its socket.
I'd assume it uses a single wildcard certificate.
Yes, thats exactly how it works for the multiple subdomains.