I would add the DO API being all or nothing with permissions to that list. Not being able to give just DNS access to a script for updating LE/ACME DNS challeng

I would add the DO API being all or nothing with permissions to that list. Not being able to give just DNS access to a script for updating LE/ACME DNS challenges means it'd be a non-starter at work.