Let's Encrypt now supports ACME-CAA: closing the DV loophole
>> Except, when this Domain Validation is performed, you don't have a certificate yet. That's why you're going through the process in the first place: to get a certificate. Which means that when the CA verifies that your domain is correctly hosting the challenge, it does so via ordinary, unencrypted HTTP... which can be trivially subject to man-in-the-middle attacks.This is not completely true.For HTTP challenge, yes its true. But for DNS Challenge its not.DNS Challenge requires the provisioning of a special DNS Text record. Assuming you are using an API with your DNS provider this can happen over HTTPS. (Indeed I can confidently say it would Have to be over HTTPS, or similar.)