I wish DNS providers offered more granular access control. Some offer an API key per zone, others have a single key which grants access to every single zone in your account. I haven't come across any that offer "acme-only" APIs.

It's on my long list of potential side projects, but I don't think I'll ever gey around to it