Yes you can do all of this on AWS with Route 53, AWS CLI/API and AWS fine-grained policies. You can integrate it with the Lets Encrypt pre/post hooks and setup

Yes you can do all of this on AWS with Route 53, AWS CLI/API and AWS fine-grained policies. You can integrate it with the Lets Encrypt pre/post hooks and setup domain-specific keys for each specific update server.