Do you know of 0-RTT implementation efforts on reverse proxies, say, nginx?

Let's say I run a static website and I'm 100% sure unauthenticated GET won't break anything, is there anything special I need to do or is it going to be "enable this flag"?

Another question: Can I set 0-RTT per vhost (sni) or do I need dedicated 0-RTT IPs?

There is no 0-RTT implementation in servers that I know of, except our internal one at Cloudflare, which currently waits for the Finished confirmation until we decide on a policy.

The following two questions are of course implementation-specific, but there is nothing in the protocol blocking a "just do 0-RTT" flag or vhost configs.

I have one question.

What prevents a Sufficiently Incompetent Implementer from manually ignoring all known GREASE values, while still doing something crazy otherwise?

Ultimately we can't do anything about a server that is near-maliciously determined to be wrong. The hope is we can at least defend against some of the common genuine mistakes at fairly low cost.

The implementer that tries to special-case GREASE values must have first hit an interop problem and thus had a second or third opportunity to think about it. I would hope, at that point, they realize they're meant to ignore unknown ones!