Do you offer wildcard certs for subdomains (i.e. *.news.ycombinator.com)? I believe I had some trouble with caddy's tls internal directive when trying to do something crazy like this. Maybe you could mention it as your differentiator too.
EDIT: I currently use mkcert with caddy and it works fine for this.
EDIT: I currently use mkcert with caddy and it works fine for this.