Oh nice! Yeah that should handle the problem. I think you probably already had things this way when I posted my comment and I just didn't realize it. If so, sorry for the noise!
Yeah definitely a lot to think about. We're also considering alternatives to certbot-auto entirely such as building our own OS packages or binaries. Hoping to spend a significant amount of time getting our packaging in better shape shortly after the transition to ACMEv2.