This seems like it would work, but I can't figure out how to configure an Ingress to cause a secured Route with edge tls termination to be created (like our current routes, so we don't have to muck about with certs).

I'm not sure if Ingress can even do that, but this post seems to indicate that it can: https://blog.openshift.com/kubernetes-ingress-vs-openshift-route/