Ah, cool - I will try it then. My motivation for not requiring root is shared hosting: I have a regular user witch access to an Apache webroot directory. They

Ah, cool - I will try it then. My motivation for not requiring root is shared hosting: I have a regular user witch access to an Apache webroot directory. They didn't fully automate Let's Encrypt, but they provide a script which installs certificates for the central webserver. So I have to download and run any ACME client myself to get my certificates.