I was just digging into this a bit and discovered ACME supports a something called DNS alias mode (https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...) which allows you to add a static DNS TXT record on your core ___domain that delegates to a second ___domain. This would allow you to setup a second ___domain with DNS API (if permitted by company policy!)