We have been discussing nostr DNS for a while. Seems coukd do own ACME (like LetsEncrypt) for SSL as well, since would also need for root domains.