With LetsEncrypt, would a wildcard cert even really be necessary? You could just generate a cert for a new subdomain whenever a new user publishes an HTML game for the first time. They do have rate limits but I imagine the public one could be workable, and if not, one can always contact them to work out potential rate limit increases (there's a form on their rate limits page for it).