> could easily just reissue a new letsencrypt cert This would be visible in certificate transparency logs. MITM with the certificate they already have would be

> could easily just reissue a new letsencrypt cert This would be visible in certificate transparency logs. MITM with the certificate they already have would be impossible to observe unless you had access to the client that was being attacked.