May Onlykey protect their own site under DNSSEC?
Since Onlykey uses CloudFlare’s Nameservers protecting Onlykey under DNSSEC should only be one click away. Onlykey can sign up for CloudFlare’s Universal DNSSEC solution: Universal DNSSEC
Once Onlykey does this, the Certbot used by OnlyKey will verify the RRSIG records are accurate and only issue the TLS certificate to Onlykey’s true site–preventing the mis-issuance of the TLS certificate. Please let me know what the Onlykey team thinks of this.