That's a fight you'll have to take up with various root programs and the CA/B Forum. There are provisions that allow root program operators such as Microsoft to

That's a fight you'll have to take up with various root programs and the CA/B Forum. There are provisions that allow root program operators such as Microsoft to force Let's Encrypt to revoke certificate, though as far as I'm aware this should be limited to domains hosting phishing sites or malware. I'd argue Let's Encrypt's policy is as good as it can be while still following the policies required for root inclusion. Here's a relevant blog post[1]. [1]: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html