Hacker News Reader

and then what? serve your app under some obscure / customer unfriendly subdomain?

Even if you use a common subdomain, anecdotally I get orders of magnitude less bot traffic than not using a wildcard cert.