Make PG-Auto-Failover high-availability

I love PG-Auto-Failover, but my colleagues & managers shout "Single point of failure!" when I show them the diagram.
My suggestion is to run the monitor on a Postgres cluster, where the main & replica monitor each other, and the replica takes over if the primary fails. The worker nodes would use multi-host connection strings to connect to the primary monitor instance.
The idea is similar to MariaDB's MaxScale (where there IS a single point of failure, as Maxscale is the proxy!) which has an active & a passive instance.