The A or AAAA record is also going to come from wherever the DNS hierarchy says it should come from. If one of the organisations upstream from you in the DNS hierarchy decides they want to police what TLS certificates sites can use by hijacking the sites' DNS and pointing it to their own servers, they can do that just as easily regardless of whether those certificates come from DNS or the traditional CAs. Once they've hijacked the domain, any major CA will happily automatically issue them a valid certificate for it.