Can't be helped, validation for wildcard domains requires the TXT record in DNS as you have to prove more control over the host than with just a single domain.
Otherwise, with well-known only, you could generate a cert valid for subdomains outside of the scope belonging to you, so you have to prove that you could mess with their dns anyway as to enable you to get certs for any subdomain possible.