I trust them to maintain a secure CA (and I trust that there are adequate checks and audit mechanisms in place). I do not necessarily trust them to not muck up

I trust them to maintain a secure CA (and I trust that there are adequate checks and audit mechanisms in place). I do not necessarily trust them to not muck up my webserver configs, or to accidentally expose my private key due to some bug. While I have no reason to doubt the code quality of the official client (and I'm certainly not suggesting I suspect any malicious activity), I suspect the checks in place for the client are probably less rigorous than those for the CA itself. acme-tiny is less than 200 lines. Short enough that reviewing the code took a trivial amount of time, and now I'm using a client that I can trust completely. I could certainly do the same thing with the official client, but it would take me several hours (at least) to get to the same level of comfort.