Function challenge_record_name 

fn challenge_record_name(displayed_identifier: &str) -> String

The _acme-challenge.<name> record a DNS-01 answer for identifier (as rendered by instant_acme’s AuthorizedIdentifier’s Display, which prints *.<name> for a wildcard authorization) belongs at.

Stripping the *. here, rather than trusting the CA never to send one, is what makes an apex-plus-wildcard order collapse onto one record name – which is the entire reason this crate cannot publish one value and move on.