Almost correct, but missing the broader point once again: 1. LetsEncrypt has additional methods to help mitigate the risk of MITM attacks for HTTP-01 challenge

Almost correct, but missing the broader point once again: 1. LetsEncrypt has additional methods to help mitigate the risk of MITM attacks for HTTP-01 challenges (https://community.letsencrypt.org/t/validating-challenges-from-multiple-network-vantage-points/40955 https://community.letsencrypt.org/t/validating-challenges-fr...) 2. LetsEncrypt has restrictions on HTTP-01 validation (no wildcards) that are designed to mitigate the fallout from exploits of this vulnerability. 3. There are proposals active to try and allow website operators to disable HTTP-01 validation entirely using DNS. It's not infeasible to me that HTTP-01 could end up being retired eventually, at least for websites that have public DNS records. And most importantly: 4. This is treated as a vulnerability LetsEncrypt is not saying, "MITM attacks don't matter and HTTP is good enough". They're working on a fundamentally difficult problem (how to do identity verification for the first time when all communication methods are subject to attack), and they are rolling out the best solutions they can come up with at this time; solutions that are tangibly better than the status quo of HTTP. That is very, very different than saying, "oh, HTTP is fine for this, we can ignore working mitigations that would be easy to deploy." If there was an easy way to completely mitigate HTTP-01 attacks, LetsEncrypt would be doing it.