Might be obvious, but Cloudflare

No. Cloudflare will give a key scoped to an entire administrative domain in the Cloudflare sense like “a.com”. They will not give you a key scoped to a single entry within that domain. (That entry would be a domain in the RFC 9499 sense, but do you really expect anyone to agree on the terminology?)

In particular, there is no support for getting a key scoped to _acme-challenge.a.b.c or, even better, to a particular RR.

Maybe if you have an enterprise plan you can very awkwardly fudge it using lots of CNAMEs and subdomains.

Some DNS hosts that support old-school dynamic dns can do this. dns.he.net is an example, but they have a login system that very much stuck in the nineties.