ACME doesn't require that the client requesting issuance has access to the private key of the certificate. Access to a CSR (which only includes the public key)

ACME doesn't require that the client requesting issuance has access to the private key of the certificate. Access to a CSR (which only includes the public key) would be sufficient. Most clients support a mode where they use existing CSRs rather than requiring a private key, e.g. certbot with --csr.