I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn

I see an issue with that - but it's possible I'm too paranoid when it comes to many third parties being able to issue certificates for my domain on names I wasn't expecting.. Each to their own! Either way - assuming restricting issuance to exactly 1 name is a solved problem.. This: What? No. The mirrors would just need to install a letsencrypt-compatible client and setup SSL via that. is still a far cry from reality thanks to all the other issues. If anything, it's: What? No. Certs are just the tip of the iceberg, even if LetsEncrypt solved that problem neatly (and they don't), you have ignored the massive complexity of the issue, both the technical and organisational issues.