Generally by automating the DNS TLSA updates, just like the rest of the process of installing a certificate.
Or, Let's Encrypt could publish a TLSA record of all intermediates for users to just CNAME to. 
4 Likes