> I’d think Let’s Encrypt would make it possible to offer https on white-labeled (CNAME’d) tracking domains.

Technically, Let's Encrypt is not unique here. AFAIK, most CAs allow subdomain certs (and only validate ownership of said subdomain, not the top-level domain).

Let's Encrypt just makes it scalable financially.