Put the ACME challenges in their own DNS zones. Grant the key permission to only that zone. Risk mitigated.