[xyzzy_plugh]

Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.