Author here. A DNS challenge is equally vulnerable to MITM unless DNSSEC is used. The whole point here is that an entity which wants to MitM connections betwe

Author here. A DNS challenge is equally vulnerable to MITM unless DNSSEC is used. The whole point here is that an entity which wants to MitM connections between a browser and website can obtain a certificate if they can MitM connections between a CA's validator and that website. If that validation isn't cryptographically secured, it's moot whether it uses HTTP or DNS from a security perspective.