issuance that does not need the machine reachable

The ordinary way to obtain a certificate for a name is to let the outside world fetch a token from the address that name resolves to. It is the path with the fewest moving parts, and it assumed something that stopped being true: that the machine answering for the name is directly reachable at it. Once the service sat behind a routing layer on a management machine, the fetch could not complete, and the acquisition loop retried for days. No certificate, and no failure anyone was watching.

The alternative is to prove control of the name by publishing a record in the name's own zone. The authority never needs to reach the machine; it reads the domain. For an estate whose default is that nothing is reachable, this is the only shape that generalises.

It moves the dependencies rather than removing them. Issuance now needs a credential for the zone, delivered to the workload: rendered into the job from the workload's own store entry under a policy scoped to that job's identity, rather than pasted into a specification where it would outlive every rotation. It also needs name resolution pinned to a resolver that both sides see the same way, otherwise the check and the authority can disagree about what is published.

What it proves is that identity work sits downstream of exposure posture. If a machine is not supposed to be reachable, the way it proves it owns a name has to stop requiring reachability, and that decision is cheaper to make before the retry loop is days old.