As opposed to something like RapidSSL which would require an MX record change? Point the MX record to an intermediary server which forwards all non-RapidSSL e-

As opposed to something like RapidSSL which would require an MX record change? Point the MX record to an intermediary server which forwards all non-RapidSSL e-mail (so no one notices an interruption) and captures the RapidSSL messages for you. Generate certificate. Once you have the certificate, you can swap the A record over to your own machine and no one would be any wiser.