Yes, my journey through multisite has given me the same ideas.
It could just as easily be turned into its own playbook that you just run when needed. new_ssl.yml or something similar.
Also, @Simeon, feel free to contribute to the docs 
Btw so far I only tried this with subdomains. I may try it with subfolders and domain mapping shortly, just to be adventurous. I should also mention that I’m using a mu-plugin for Bedrock from a pending Github pull request to fix main site URLs which eliminates the need for db URL tweaking and @darjanpanic’s fix here. That fix does the trick but ends up removing /wp/ from the admin paths and that creeps me out.