Re: acme-client: add challenge hook to support dns-01

> populated by the acme-client hook and cleared after authorization.
> nsd can reload zonefiles on SIGHUP.

Sending the signal requires privs. What's the plan?