The zone authority already superseeds the CA authority in all ways

When I manage a DNS zone, I'm free to generate all certificates I want