I've managed to answer my own question....
Hopefully it holds up in an HA environment. With assistance from Ansible it very well should. Any correction/improvement to this model from the Zimbra world is very much welcomed!
- Each Proxy (2 proxies are running in my use case) has been configured with all virtual hosts and all related SSL's have been RSYNC'd from the master proxy.
- An HAproxy loadbalancer is running in front of all Zimbra proxies.
- Heartbeat detects health of proxy and directs traffic to healthy nodes.
- On proxy node failure, Ansible (automation is important, choose a good platform!) is alerted and a script/playbook spins up a duplicate configuration as a new slave proxy.
- The failed node is automatically disabled and the new, automatically provisioned proxy takes its place
- *The master proxy holds all Virtual/Secondary IP information and replicates to the replacement proxy if the master proxy is the failed node.
Cant wait for version 9 to come out as these SNI issues regarding virtual/secondary IP are supposed to go away. Again Ansible really helps in this situation. You could of course do everything manually but with a tool like Ansible or Salt thats simply being lazy and stupid.