Maybe I'm missing something obvious, but seems to be much more up to the security of my DNS setup rather than the command.

The command would basically hit "keys.my-domain.example" and return the values of each TXT record. Not sure what could go wrong here, besides if I lose DNS access, I won't have access to the boxes. Probably add some sort of caching as well for that.

But otherwise, it seems to be much more about the security of what goes into "keys.my-domain.example".

That's what I meant. Just looking up a DNS record as an implementation sounds like a bad idea. You would have to set up thinks like DNSSec validation, and consider all the ways in which that could fail.