I think what matters is whether the certificate authorities honour TTL correctly when they do domain-control validation. If they do, then the procedure above (

I think what matters is whether the certificate authorities honour TTL correctly when they do domain-control validation. If they do, then the procedure above (and doing everything over https) should be enough, I think.