The former is in the howto, the second… was the culprit 
Now I get a secure _t cookie.
I still think this is a bug: If Discourse doesn’t see that the request came via HTTPS, it shouldn’t just drop the cookie entirely, but either still deliver the secure flag (it would have worked in my case!), or deliver the cookie without it.
(I prefer blindly delivering the secure flag. That feels intuitive, and there already is a HUGE warning that the site will break without proper HTTPS, so Discourse should just trust the user that HTTPS is handled, somewhere, period.)