[MaxBarraclough]

I see HackerNews chewed up your formatting. An extra newline between bullet-points is necessary.

> You use a dynamic subsubdomain scheme

Good point. If you run a site that creates a new subdomain per customer, and uses subsubdomains, you might end up making a high volume of cert requests. I don't know a lot about this stuff but presumably there are paid CAs that offer a more generous rate limit than Let's Encrypt?

> You embed resources that are only available over HTTP and cannot be proxied, either for technical or legal reasons

When is this a problem?

> You request resources from a local IP address, e.g. a website hosted on GitLab Pages that shows you the data from your own DIY weather station which runs in your local network

I don't follow here. If for some reason you need to present that data as a local HTTP service, that service could just act as a proxy to GitLab Pages over HTTPS, no?