This really comes down to the weakest link though. You can use letsencrypt if you want, but someone else can still spoof your domain with a fake Comodo cert and

This really comes down to the weakest link though. You can use letsencrypt if you want, but someone else can still spoof your domain with a fake Comodo cert and any of your users' browsers will happily trust it. Public key pinning seems like it would prevent this attack though.