For those reading later, a adding a regular domain was sufficient for my use case. Whenever it gets blocked, which is often, .ic0.app is still accessible (and authenticates with the same principals), which is just something you’d have to communicate in the worst case scenario.