[lazulicurio]

You could do something similar to how FF implemented their new cookie isolation.

Make the key (original domain ^ final CNAME).

Which probably would still have issues, but I think it's worth looking into.