The best way of explaining tls-sni-01 is that its broken such that it allows the user to shoot themselves in the foot in a bad way. When I wrote an implementat

The best way of explaining tls-sni-01 is that its broken such that it allows the user to shoot themselves in the foot in a bad way. When I wrote an implementation of LE with tls-sni-01 I was quite shocked that it worked that way when dns and HTTP were done "correctly". I would be very surprised if this was related to their reason for pulling tls-sni-01.