[erincandescent]

Put the ACME challenges in their own DNS zones. Grant the key permission to only that zone. Risk mitigated.

[crtasm]

Is this possible on Porkbun?