Actually, I was thinking too small. Could this then in effect be used to serve the initial DNS A Record?
DNS bootstrap-> No-DNS cert validation
No-DNS bootstrap-> other No-DNS cert valid self hosted DNS servers?
Does that work? I might have confused myself.