To my understanding, LetsEncrypt DNS verification works by setting a static TXT record into DNS (basically just a nonce) which is then checked by the LetsEncrypt servers.
When I first heard about it I was pretty excited and expected something more sophisticated: A public key is stored in DNS of my domains. Then, for verification, I create a signed message and the LetsEncrypt server checks is the signature is valid. Since public key in DNS and private key I own, this establishes proof that I control the domain.
Finding out that it does not work this way was a bit disappointing: It requires manual interactions and even for renewal a new TXT record.
Is there a technical reason that no signature approach is used? If no, what is the reason why LetsEncrypt does not implement it?