For ipv6 proof of ownership can easily be done with an outbound connection instead. And would work great for provisioning certs for internal only services.