If not using something like bind, but willing to run a dedicated dns server for acme challenges, acmedns offers something similar. When you generate a new account, it gets given a unique subdomain. You then cname the challenge domain to the acmedns subdomain and the account can only affect the associated subdomain.