Hacker News Reader

About the last thing security-wise that I want is for http server to control DNS record (which is required to have wildcard certs in LE)

When done properly, this is less of an attack vector than you think (certainly much less than a phishing email).