My automation tools are slowly migrating towards a proper PKI set up that supports ACME, self signed certs and external certs (vendor signed certs from anywhere

My automation tools are slowly migrating towards a proper PKI set up that supports ACME, self signed certs and external certs (vendor signed certs from anywhere). I first saw this strategy used in the DebOps project's PKI Ansible role at https://docs.debops.org/en/latest/ansible/roles/debops.pki/ https://docs.debops.org/en/latest/ansible/roles/debops.pki/. Basically if LE goes down, all I have to do is make 1 line of YAML changes, run an Ansible script and my servers are secured by a different provider's certificate.