Hi @adleviton. Thank you so much for taking your time to write this precise answer!! 
I tried (for days) to implement your solution (but unfortunately hit the same road block that I am hitting with Let’s Encrypt. So it probably doesn’t have to do with your solution but rather something else in my setup…).
For completeness, and maybe helpful to some others: One thing that didn’t work out of the box for me was, that it is looking for the certs and keys on the server in /etc/ngincx/ssl/ … (which is different from the ‘manual’ provider, which (as far as I understand) first copies the certs and keys from a local directory such as ~/.ssl/ to server and then references them … which apparently is also safer?…… either way, I ended up copying them over manually to try out the rest and then it provisions and deploys fine 
Nonetheless, in my setup I am hitting a roadblock. I also followed @strarsis two cents and tried with LE instead, but the roadblock (in variations) stays the same: I can’t login to the wp-admin of some of the subdomains. (I know there is a few topics on multisite login issues, but since I couldn’t find any solution to my specific case on the roots discourse here (or the first few pages on google for that matter), I will open up a new topic for that and link it here. If either of you two, have the chance to take a look on that, and stop me from quite literally pulling out my hairs on that one 
… I, and my hairline, would HIGHLY appreciate it → Admin login issues on Multisite subdomains …
thanks again for your previous answers 