In most cases I delete the account key right after verifying the domain and getting a cert, and let certbot generate a new one every time.

We route the '/.well-known/acme-challenge' request to the standalone server (we use haproxy ACLs 'path_beg' to route it to a dedicated port on localhost) so it hasn't been a problem running the validation every time for every new cert.

And per TFA, the timeout for validation on their side (what they call Authz or authorization token) is about the same as the timeout for renewal, so you can't really depend on not needing to validate the domain even with the account key. I'd much rather have the code path be identical every time, rather than different for new cert vs renewal cert, and then also different every other time you renew due to authz expiry.