"Certificates are only valid for a single domain, after all"

Actually that's not the case, you can get single certificates which cover different domains, using the Subject Alternative Name field.