Find a way to do both. Add a menu option to ask if they intend to use use https, and if so, host their content in a bucket that you don't CNAME. Host everybody else in a CNAME'd bucket. Don't worry about the extra complexity of the user interface, it's worth it.