Copying my comment from above in the hope it gets more listen as it's a path for option #1, which if practical for your ops team, seems best.

I was disappointed to hear about the limit to wildcard certs. digicert.com/welcome/wildcard-plus.htm purports to sell certs that will work for foo.bar.example.com and bar.example.com - Their copy says: Even more, DigiCert WildCard ssl certificates are unique in allowing you to secure ANY subdomain of your domain, including multiple levels of subdomains with one certificate. For example, your WildCard for *.digicert.com com could include server1.sub.mail.digicert.com as a subject alternate name.

I am not affiliated with digicert in anyway; just surprised by the issue, googled, and well...