The question is: How does LetsEncrypt handle concurrent dns validations?
And the answer seems to be:
Use the same LE account on multiple systems to reduce (part of the) validation.
Centralize DNS validations to only one system.
Delete any “old” records at will.
That seems to be less than ideal for someone who can’t do any of those options.
…
Maybe DNS scavenging could automatically delete stale TXT records in the challenge zone…
And we haven’t really covered rate limits accurately in the response.