Who knew, free certificates with dns validation and automatic renewal if used for a free (up to some limit anyway) cdn... Anyway, PeerTube is now upgraded to v4 and the videos moved to S3 object storage. I initially messed up CORS, of course, as always, but it works now. And I didn't even want to use a CDN, but it is the only way to use a CNAME instead of the bucket address and still use https instead of http.