On this note, I wonder if there is any way to get a google cloud account, and use it JUST for this, without any $$. I don't think so, right? because best option you still need some sort of reverse proxy to your own server?!
As far as I can tell (I now have the API access, so I might test later), you only need to provide additional authentication credentials to Certbot. The private key stays on your server. The CA server _might_ reject requests that do not come from GCP, or attempt to obtain one for a domain name not setup with GCP.
There is no origin limitation. It works on premise or cross cloud.