We found the problem and have fixed it. It will take a bit of time to propagate to all DNS servers, but it does work right now with 1.1.1.1:
$ dig +short brave-browser-apt-release.s3.brave.com @1.1.1.1
d9owkidwx4k9e.cloudfront.net.
13.224.10.67
13.224.10.44
13.224.10.7
13.224.10.88