I get antsy about a private key being in lots of places. You've also got to worry about renewal so you might as well just have "consumer" of the wildcard just provision its own non-wildcard certificate.
replyI run a reverse proxy that handles the TLS termination for that reason.
replyServices themselves are constrained to the server, bound to listen on 127.0.0.1 only.
Key is only available to the reverse proxy.