It turns out you can simply serve a file from a domain to use it as your bsky handle.

So this guy is now S3. All of S3.

@jonty Absolutely beautiful! They design the verification to work on DNS, but then create a fallback that does NOT use DNS - yet validates domains.
WebFinger as it is used here isn't much better, but its saving grace is that it validates [email protected] profiles, not naked domains.