> Many people seem to solve the "automate DNS" by putting their DNS credentials on the server which serves their website. This is the worst thing from a security perspective.

Indeed. That's why I have a single machine that I use for running acme. (Maybe people don't realize that you don't have to run the acme client on the same machine where the certificate will ultimately be deployed?) It contains all my keys (ssh keys, acme account keys, API tokens) in an encrypted database and a set of scripts for getting updated certificates and installing them. This machine has no open incoming IP ports, only outgoing SSH and HTTPS connections. It also contains copies of all my source code and deployment scripts. I could in theory tear down my entire production infrastructure and rebuild it with a single command from this machine.