[takeda]

If you provide PTR that points back to that name, configure web server to handle requests to that name, you basically makes the domain an official one.

As your users start using it, the owner of the name can now point the AAAA record to another server that will act as a proxy, request a new certificate (he owns the domain) and see all the encrypted communication.

[treysis]

But you don't need PTR in any of these steps.