The automatic restart could definitely work (since graceful is enough and doesn't cause downtime). Though it's better if unnecessary stuff isn't done on the server.

The other option with MDMessageCmd, would require (on a SELinux distro) to grant Apache command exec permissions, among other tweaks.

What would be better in this case were if Apache could message via DBus these events and I could make a dbus service that listens and restarts accordingly (better execution isolation).

If Apache would do internally the certificate swap, now that would be perfect.