Comment by mcpherrinm

At least for Let’s Encrypt, you can also use CAA to require a specific account as well or validation method. This could prevent your hosting provider from issuing on your behalf if they don’t control DNS.

https://letsencrypt.org/docs/caa/#the-accounturi-parameter