If you want to do this another way, Tailscale funnel can send public traffic into your tailnet Traefik supports pulling the Tailscale cert from its socket.

I'd assume it uses a single wildcard certificate.

Yes, thats exactly how it works for the multiple subdomains.