"Any traffic using TLS to establish destination authenticity (e.g DNS TLS, DNS over HTTP)" Well, unless you can also fool Let's Encrypt from all their location

"Any traffic using TLS to establish destination authenticity (e.g DNS TLS, DNS over HTTP)" Well, unless you can also fool Let's Encrypt from all their locations around the world. Then you can get a Let's Encrypt certificate.