Same. I have a router with OPNsense. In the "Dynamic DNS" section I create a "Custom" service with the DynDNS2 protocol. I type in update.dedyn.io as the server address. You need to also get an api key from the desec.io web panel that you input into the username and password fields.

Now everytime the router's WAN ip changes it automatically edits the DNS zone. So instead of going "your server -> DDNS provider -> DNS CNAME record" it's just "your server -> DNS A record"

I also have a separate token for my web proxy (traefik) so that it can edit the DNS records to get let's encrypt certificates through dns challenge as you describe.

As for the desec signups in my case one DNS zone was no problem, but for a second one I needed to e-mail them:

Hello, would it be possible for my newly created account to get one more domain on the account please? I have two personal domains and it would be great if I could keep them both under deSEC

Hi [me], Sure! The limit is mostly there to remind users to enable DNSSEC, but it looks like you're already doing that (at your old provider).

They asked me to (voluntarily) donate, which I did too.