solve the DNS auth hurdle, not the
    overall expiration hurdle

That would already be a big step forward.