I have been listening to groove salad since high school. I was happy to run into the team at defcon and express my gratitude. Also, if you love the station, don't forget to donate/support[1] them.
I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
You are correct. Once you set your distribution to SNI only and the distribution is in deployed status, clients that do not support SNI will not be able to access your distribution over https.
1. https://somafm.com/support/