Can't it? If you get a wildcard certificate? Otherwise if you are getting a domain specific certificate, you are obviously giving your cert provider the domain

Can't it? If you get a wildcard certificate? Otherwise if you are getting a domain specific certificate, you are obviously giving your cert provider the domains, and why would you assume it would be secret?