This is significantly better than my draft of DNS-ACCOUNT-01. Thank you Let's Encrypt team!