voron121

Http/2 actually means that using a cookieless domain isn't worth the pay off any more. Previously, the concern was the additional bandwidth and therefore loss of speed by including a few kb of cookies in each request. But now with http/2 the additional overhead of making a new connection, the lookup, the ssl handshake etc is actually slower than having everything requested off of the same domain, even if that means each request includes cookies - particularly since http/2 compresses them.
https://blog.theodo.com/2019/09/cookieless-domain-http2-world/
https://www.hostnexus.com/blog/http2-site-optimization/
So, the optimal way to do it would appear to be to drop the cookieless domain entirely. 
 
 

I don't disagree, and I think it makes sense. However, I would dispute your claim that it requires a new dns lookup, tcp connection and tls setup - it is fetching from the same server as the main content so if your server is correctly configured with keep-alive it will reuse the existing connection, resulting in 0ms overhead. Even if you have keep-alive disabled (as ips did for a while, although they may have changed that now), the dns lookup will always have been cached and if you are running an up to date version of openssl and nginx/apache you can get 0- or 1-rtt tls session resumption, so there should only be 1-2 round trips of overhead.
Resending the cookies is still a reasonable concern, but the others are not.

When a cookie-free domain  is used, all resources are loaded by that cookie-free  domain, including links in the contents of the manifest file.
But, the initiator for loading manifest.webmanifest does not change and manifest is loaded from the primary domain.
This causes:
- DNS lookup
- new connecting
- new SSL,
or about 200 ms delay for loading manifest file.
If possible, include a cookie-free domain for loading manifest file,  when used - this will speed up the loading site.
Thanks