assigning different SSL cert -- per ingress/listener IP?

[J.R.]

> I'd _like_ to setup different SSL cert/key/CA handshake configs to be used
> -- depending on the ingress IP.

You can specify an IP with the listen directive:

http://nginx.org/en/docs/http/ngx_http_core_module.html#listen

So you would end up with two similar copies of each 'server'... The
only difference in directives being listen and the ssl certs...