That is indeed what seems to be the most useful out of all the replies, thanks a lot!

Be warned that when using this a lot of the security comes down to your own implementation of that command.

The suggested alternative using certificates is a much more standard way that has less ways to create holes in your security.

Maybe I'm missing something obvious, but seems to be much more up to the security of my DNS setup rather than the command.

The command would basically hit "keys.my-domain.example" and return the values of each TXT record. Not sure what could go wrong here, besides if I lose DNS access, I won't have access to the boxes. Probably add some sort of caching as well for that.

But otherwise, it seems to be much more about the security of what goes into "keys.my-domain.example".

That's what I meant. Just looking up a DNS record as an implementation sounds like a bad idea. You would have to set up thinks like DNSSec validation, and consider all the ways in which that could fail.