Thing is, you may have some devices that should be accessible even if the reverse proxy is unreachable.
And if you have HSTS and wamt to reach a device under the same local DNS suffix (example: External -> service.example.org, Internal: service.int.examole.org) you can't just bypass the https warning.
Same for devices reachable over RDP, SSH, etc. etc.

How ?

I've seen nothing about that in the Caddy docs.

I must admit that one disadvantage of Caddy compared to when I was using acme.sh, is having to make a request to Let's Encrypt (even automatically) for every subdomain, making all of them visible on crt.sh