Can you not mitm the CA's dns lookups for http, tls-alpn challenges and make them sign the certificates for you? How does letsencrypt prevent this? Do they check with multiple resolvers around the world?