That's what we ended up doing. It's expensive per month, but you can roll up multiple sites under a wildcard cert (I think -- I'd have to ask the devops guy who is thankfully dealing with this mess).
Yes. The criteria for avoiding SNI is one IP per cert, not necessarily one IP per domain. If you can consolidate subdomains under one cert, you only need one IP. The issue that SNI deals with is with cert switching on a single ip:port... not anything inherently related to multiple domains on an IP.
