The design seems pretty straightforward to me, with one apparent oddity I'd like to know more about:
Is there a particular reason not to hook up SITE5 to the WAN directly, but across Site 1 ?
Assuming that the "WAN Switches" are CE devices (in extenso: something like an "extranet switch") of your customer's, and are not the carrier's CPEs, why not hook up SITE5 directly to the "WAN Switch", and have it run it's own set of DMVPN Tunnels? With the situation as shown in the diagram, reachability of SITE5 is dependent on Site 1's LAN services.
Other than that, I second Ron Maupin's suggestion to question HSRP on the WAN Routers. HSRP only makes sense if the LAN subnet/VLAN is directly attached to the WAN routers.
While this is acceptable for a small spoke site with just a single LAN switch (or single stack-of-switches), and little need for inter VLAN routing, I wouldn't do this on a hierarchical switching environment as found at medium and large sites.
In that case, do as Ron suggests: Use the distribution switch(es) as L3-switch, providing redundancy towards the LAN as the given LAN platform does (stacking, VSS, VPC-Pairing, HSRP, etc.. ), then run one or two "transit VLANs" or "routed ports" from L3-Switch(es) to one or both WAN routers, and let OSPF run across these links. No need for HSRP on the WAN routers, then, not even towards the LAN side.
Oh, and while we're at it, I suggest this:
Head towards FlexVPN (essentially that's just DMVPN with sVTI/dVTI tunnel interfaces, plus IKEv2-with-some-clever-benefits, like route-pushing) instead of DMVPN. Personally, I have found IOS/IOS-XE's IKEv2 configuraton style to be cleaner and more precise, and therefore easier to understand and troubleshoot. By comparison, IKEv1 ("crypto isakmp ...") seems convoluted and a lot more "... huh!?" to me - but YMMV. ASR1001-Xs definitely are FlexVPN capable, and all the ISR-G2 generation, too (890, 1900, 2900, 3900), and the ISR 4000 series in any case. The ISR-G1 series (1800, 2800, 3800) however, well, probably they won't.
depending on how trusted the WAN service provider is deemed by your customer, consider using "frontdoor VRFs" for the WAN; if the interface towards your carrier connects to a routing instance that has only one single interface, there's no way "through" the router from the carrier network. It's pretty straightforward to set up in IKEv2, PKI client config bits and the sVTI/dVTI interfaces.