Access to this /certificates.txt would need to be done over a TLS connection as an attacker could insert their own certs here. ACME avoids this by associating

Access to this /certificates.txt would need to be done over a TLS connection as an attacker could insert their own certs here. ACME avoids this by associating a specific CSR to a response, so an attacker could not insert their own certificate in the middle of the process and get it signed.