Doesn’t certbot with the nginx plugin on the host just work?

This is 100% not the advice you are looking for, but if you don’t need the service to have a domain I would consider just using Tailscale. It’s pretty damn good.

Ugh, I hate it when tools to “simplify” an already relatively simple process actually oversimplify it to the point of making it horribly complex to work around their “simplification”. A few points I’d like to answer from your post:

• Nginx-Proxy-Manager is dumb for, as far as I can see, not allowing you to follow the standardized method of answering challenges that supports any DNS provider and instead only seems to allow its “magic simplified process” that only works with select DNS providers
• dns.he.net is a nice free DNS service that you could use for your “keep domain at bluehost but use DNS servers elsewhere” strategy, and this is a totally valid and reasonable configuration – however, it apparently won’t help with Nginx-Proxy-Manager due to above stupidity
• This leaves your only DNS hosting service option as Cloudflare, as you correctly identified. This is a fine option but you know what they say about free services especially when they’ve got big for-profit companies behind them, if you’re not paying for the product, then you ARE the product, so beware of becoming vendor-locked and enshittified when they inevitably decide to try to monetize you somehow (if they’re not already doing so behind the scenes).
• Yes you can transfer your domain to a supported provider. This is kind of a “nuclear option” to get it to work with some shitty web-UI like Nginx-Proxy-Manager just because they’re too lazy to support actual standards or play nice with manual configurations, but it’s straightforward, albeit a little bit slow process (can take several days for things to switch over)
• There is no “renewal cost” for transferring a domain other than having to pay for 1 year minimum of the new provider’s normal annual registration costs. This gets added to your existing expiry, generally speaking, or your old time gets refunded, so either way you’re not losing anything, however things can get complex if you’ve only recently registered or renewed it, for example

If you’re very happy with Bluehost and want to stay there (I have no idea if they’re any good I’m not familiar with them but I will say charging $90 for an SSL certificate seems a bit absurd) then Cloudflare is probably the path of least resistance.

If you don’t mind transferring your domain and waiting for that process, that’s also a good approach.

But personally, I would drop Nginx-Proxy-Manager like a hot potato and work your way through setting up something like Caddy instead, doing mostly the same magic that NPM does (unfortunate acronym for anyone who’s more familiar with Node Package Manager) but using a very open and flexible system, supporting plugins for different providers to support DNS challenges for example

One final option that I’m going to throw out there, is if you intend on connecting your web server to the public internet anyway, and you’re able to live without a wildcard DNS (this just means it has to create a different certificate for each subdomain you add, not a big deal when a program is already managing them for you in my opinion) then you can just forget about the DNS challenge altogether and use a regular HTTP challenge. Again, fully standards compliant. Doesn’t matter what DNS or web server you’re using. As long as it has an internet connection so it can talk to the encryption certificate server and verify that it is who it says it is, you’re good to go, no need for DNS keys and such. Frankly I find the HTTP method just as simple if not simpler in most cases. Again, they’re oversimplifying to the point of making it more complex.

Of your after a wildcard certificate I can recommend OVH for both domain registrar and DNS hosting, they have an API to allow certbot to get both single domains and wildcard certs.

I use OVH for DNS, vps and dedicated server

AFAIU bluehost does not support the acme protocol, so you’ll either have to manage your certificate manually or (recommended!) move to a different dns registrar.

If you are wondering which provider you should switch to, basically all the serious ones will work… IDK if this is relevant for nginx, but here’s a list of the supported ones for the client I use go-acme.github.io/lego/dns/

If you are unsure and want to experiment before touching your current setup, you could register a new cheap domain (less than 1$, see tld-list.com), use it for your tests, and then not renew it.

I just self-host my own DNS server. Works like a charm. Setting up DNSSEC was a tad fiddly tho.

Long story short:
1. Set up Knot, teach it to serve your zone
2. Test via resolving names in your server (dig can use a specific server)
3. Disable DNSSEC
4. Tell your registrar to "use my own DNS server"
5. Generate the DNSSEC keys, upload only the pubkey to registrar, reenable

A few things

• move your name server to a public DNS service that has an API like Linode Domains or Route53

• set your public A/AAAA to parked

• setup an internal DNS server and configure devices to use it via DHCP

• Setup Caddy with the DNS plugin for ACME. This will allow you to get certs locally without exposing anything.

There is little reason for companies to pay for certs let alone individuals. Use Let’s encrypt as it is easy and free.