Downsides of a single wildcard certificate has its own issues, the more you pass a single certificate round the more opportunity for it to leak and the wider th

Downsides of a single wildcard certificate has its own issues, the more you pass a single certificate round the more opportunity for it to leak and the wider the risk If you have a per-host DNS based with no valid A records, DOH could well mean worse performance in future as devices don't listen to canary domain and only query locally once getting an NXDOMAIN (and even then might not). You're still leaking the CN and SAN entries via CT. If you run your own CA, every device has to have it installed, and it's a major security risk as losing control of the CA means all your machines can be compromised. Between certificate transparency and DNS over HTTPS, there's no perfect answer.