Verify DNSSEC validation and CAA records that lock down who can issue certs.
We query DNSSEC (DS + validation flag) and CAA records over DNS-over-HTTPS.