Getting ready to issue IP address certificates

This seems to be for public IP addresses, not private RFC1918 ipv4 range addresses.

The only challenges possible are HTTP and TLS-ALPN, not DNS, so the "proof" that you own the IP is that LetsEncrypt can contact it?

Yes, which is the same way control of a domain name is typically checked; DNS is only used in a minority of cases as it can't be as turnkey.

Having DNS available wouldn't be any more "proof". The person applying gets to choose which form of proof will be provided, so adding more options can only ever make it easier to "prove" things.

I don't happen to know if it's actively in use, or whether any of the technical implementation details were formally standardized, but one obvious thing goes like this:

1. Write a DNS record for CAA the Certificate Authority Authorization for your names

2. In the CAA record, say that you forbid anybody except your chosen CA to issue. Competent CAs will obey this instruction (obeying it is mandated by the root trust stores, there are bugs of course but on the whole compliance is very good and is separate from their implementation of specific validation methods)

3. Further, indicate, either in this record or by agreement with your chosen CA, that they must use DNS proof of control. This might be something very nerdy like indicating a specific OID for the method in the CAA record or it might be a Memorandum of Understanding somebody signed and then they went out for a nice lunch.

Yes, this is a thing: https://www.rfc-editor.org/rfc/rfc8657.html#name-extensions-...