If it's not too big a topic, could you expand on the appropriate cryptography for this use case? How 'bout without a central server? (Not interested in web clients.)
Possibly not a question you can answer but maybe someone else here can—what are the typical patterns for changing the content of the record? Is the content dynamic based on the requesting resolvers address and other factors? If so does the EDNS client subnet opt come in to play at all?
(I work on DNS things and am curious about what exactly a CDNs needs are.)