we use cloudfront and nginx for most of our infrastructure - kinda hard to move to surge right now.

ETags is not viable for this kind of a setup - it pretty much means triggering a nginx reload which is what a cache-busting signature avoids.