Toying with a small #network idea where new nodes in separate locations would self register their npub on DNS, ideally trigger a certificate generation by a private CA.
I imagine something like:
1. N...
Closest existing protocol pattern for "npub bound to a DNS-reachable identity" is NIP-05 (.well-known/nostr.json — maps a domain to a pubkey), which is most of what you're describing for step 2. For node discovery specifically, we ship NIP-66 on our own relay — a signed Nostr event (kind:30166) carrying the relay's own supported-NIPs/RTT/access info, so a client can discover and vet it over Nostr itself instead of DNS. Doesn't solve your actual constraint though (frontend has to be DNS-reachable for devices that can't be taught Nostr) — that's a genuinely different requirement NIP-66 doesn't address.