How do cut out ISP trust for HTTP-01 ACME requests?

When renewing SSL certificates, CAs make plaintext HTTP requests which can be intercepted by your ISP.

My problem with this is that it is hard to distinguish between a compromised CA and a compromised ISP without cryptographic guarantees.

Other ACME request types exist. A CA could use the existing server certificate when performing an ACME check to update that certificate for example.

What should I read about here?