For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can trivially request a new valid certificate with letsencrypt.
I have so far used HPKP to avoid this situation. Since HPKP is now a persona non grata, which alternatives exist?
Wikipedia mentions Expect-CT but that also doesn't help in this case.