I think you could always get a cert via the ACME DNS challenge for an IPv6-only/AAAA-only domain. But you could not talk to the ACME/API endpoint from an IPv6-only system, so actually requesting and retrieving the cert would have to happen on another, IPv4, system.

(Just as a sidenote: you _never_ need to request and retrieve the cert on the system that the domain name points to. That is just the easiest way and the workflow most clients suggest, since it also makes a lot of sense.)

Yup.