The main issues are:
pid1 can often be non-dumpable, which can block you from doing that. In principle, because the dumpable flag is reset on execve, it is theoretically possible to get access to /proc/$pid/ns/pid if you win the race in a pid namespace with lots of process activity, but this kind of sucks.
This approach doesn't work for empty pid namesapces. pidns_for_children doesn't let you get a handle to an empty pid namespace either (I briefly looked at the history and it seems this was silently changed in v2 of the patchset based on some feedback that I'm not sure was entirely correct).
Now that you can configure the procfs mount, it seems like a half-baked interface to not provide diagnostic information about the namespace. (I suspect the criu folks would be happy to have this too ;).)
I think the easiest would be to add an ioctl that returns a pid namespace based on a procfs root if the caller is located in the pid namespace of the procfs instance (like current_in_namespace(proc->pid_ns) or if the caller is privileged over the owning ns. That would be simple and doesn't need to involve any ptrace.