For what it's worth, here is the original thread:
https://news.ycombinator.com/item?id=13011120
This should definitely meet our needs in both cases: serving prerendered content when necessary, and also adding the security headers to the front end. And it's definitely a 10x better solution than having an extra EC2 instance with your private certs on it, just to run an nginx proxy with twenty lines of code.