If we do use certbot, perhaps use danebot as well?

This is a really good idea if you're using certbot with ispconfig; https://github.com/tlsaware/danebot
I've also been using this: https://github.com/ekollof/gentlsa to generate DNS records for cloudflare

Good to know regarding the correct DANE TLSA record flow: https://mail.sys4.de/pipermail/dane-users/2018-February/000440.html