Why would it be impossible to maintain? All you need is one self-generated SSL certificate that's shared across all domains. Web browsers will say the certificate is insecure, but Cloudflare doesn't care and gives out another trusted certificate anyway. You should keep custom SSL certificates a paid-only feature to encourage customers to upgrade.