As someone implementing the S3 API (on Ceph) for a non-profit, another missing option is wildcard certificates.