It absolutely has to do with ACME. There used to be CAs that would generate a service certificate including private key for you. This is obviously a terrible id

It absolutely has to do with ACME. There used to be CAs that would generate a service certificate including private key for you. This is obviously a terrible idea, but it is made impossible by ACME only allowing exchanging CSRs for certs.