I'm not sure I follow? What I was trying to say was that it's a good idea to have one key per DISTINCT($attack_surface), which includes anything from physical

I'm not sure I follow? What I was trying to say was that it's a good idea to have one key per DISTINCT($attack_surface), which includes anything from physical security to the software stack, in order to limit the damage during a compromise. Throwing wildcards at everything tends to go against that principle, even though I admit there are use-cases where wildcards are entirely appropriate (namely those where each subdomain has the exact same attack surface anyway), and using something else isn't worth the trouble.