An update: I was using certbot with an internal address, which explains why certbot certonly did not work when it uses a self-hosted web server and webroot. But

An update: I was using certbot with an internal address, which explains why certbot certonly did not work when it uses a self-hosted web server and webroot. But, there is still definitely something weird about using preferred-challenge dns + manual mode, the acme-challenge TXT records do not show up in the Google dashboard.