Comment by jsheard

I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure.