With bind9 you can limit each server to being able to set the TXT record for the specific cert it needs: https://news.ycombinator.com/item?id=47066072