Yes, it does.

I run acme in a non privileged jail whose file system I can access from outside the jail.

So acme sees and accesses nothing and I can pluck results out with Unix primitives from the outside.

Yes, I use dns mode. Yes, my dns server is also a (different) jail.