I'd argue that the right thing for certbot to do is to parse nginx's config and if there's that directive and it's not 128, complain.