Since Certbot was mentioned you should know that it does not natively support dns-01 challenges for delegated domain names (either CNAME or NS). It only updates the _acme-challenge TXT record related to a domain name requested for the certificate.
Certbot works with acme-dns only because acme-dns provides a custom plugin.
You can write custom hooks to handle delegations. It just isn't available as-is.
@rblumlei Hasn't Sectigo given you any advice on how best to get certs with its system? Isn't that part of what you pay them for? We talked about this back in June. Even though you decided to stay with Sectigo the same background about Let's Encrypt and Certbot remain. See: Certbot release levels, and switching from Sectigo to CertiNext - #2 by MikeMcQ