I asked this question the last time LetsEncrypt came up, and got a very good answer: M2Ys4U 35 days ago According to their 31C3 talk, they will use multip

I asked this question the last time LetsEncrypt came up, and got a very good answer: M2Ys4U 35 days ago According to their 31C3 talk, they will use multiple connections from multiple locations (possibly including Tor?) to mitigate against these attacks. So they validate it fairly extensively to make sure it really is the domain.