Correct cross-zone CNAME handling in proof generation