ACME-DNS provide credentials for each domain. Each credential is allowed to update only its subdomain record.