I was not familiar with DANE:<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DNS-based_Authentication_of_Named_Entities" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DNS-based_Authentication_of_Na...</a><p>Until the CA system is completely abolished, this appears to works great with LE -- free certificates <i>and</i> a guarantee that no other CA can impersonate you.<p>The ACME protocol could conceivably be extended to update SRV records along with the certificate for some DNS providers.