As I understand it, the ACME protocol used by services like LetsEncrypt simply proves you control a domain. But to my rather security-naive self, it seems like you could just put a TLS public key directly in a domain record, and have browsers read that. I'm confident there are good reasons this won't work, and I can even guess at a few, but I'm looking for good resources that explain the ins and outs of the security implications here.