Cool! I hadn't seen tls-alpn-01 for authentication before.

Instead of using the ualpn daemon to respond to the challenges and proxying all other connections through to nginx, would it be possible to do it solely in nginx?