Comment by dns_snek

> Am I being too paranoid here? Or is there a better way to allow DNS challenges without a token that allows too much power in editing a DNS zone?

I'd look for a custom DNS challenge provider plugin which delegates the task of creating DNS records to another machine which holds the actual token.