While working on gdnsd-3.x anyways (in support of other upcoming WMF needs), should add all the necessary infrastructure/code to support ACME DNS challenges, most likely in the form of generic custom TXT record outputs from a watched disk file. Possibly should have a pushed trigger mechanism for syncing remote challenge updates quickly.
Status: @BBlack has written support into gdnsd in https://github.com/gdnsd/gdnsd/commit/db7fff10b005b951890fa4ff7c843a1e37bbdc58 (as well as a follow up or two) and I've made https://gerrit.wikimedia.org/r/#/c/operations/puppet/+/459809/
Beta releases of gdnsd (supporting this new feature) have been stable on our production authdns since mid-last-week. The code hasn't been released officially as gdnsd-3.x for the rest of the world yet, but we're done here in terms of feature blockers in production practice.