Step 2: CNAME it to techaro.lol

Wouldn’t that just resolve to IP of techaro, thus providing a “wrong” TLS certificate?