they don't "hold the keys to the servers" - I believe you have a fundamental misunderstanding of how an X509 SSL PKI works. The people in possession of the priv

they don't "hold the keys to the servers" - I believe you have a fundamental misunderstanding of how an X509 SSL PKI works. The people in possession of the private keys generate the cert signing request on their local machine. The CSR is then sent to Letsencrypt. The private keys never leave the system requesting the key signature. If you mean is it dangerous for one organization to have a root CA that if it went entirely rogue could theoretically be used to MITM peoples' traffic, that is definitely a concern, and why a process exists for removing a root CA from the mozilla, chrome, microsoft etc root CA trust stores.