The CSR is signed by the key that is going to be used for HTTPS on the website requesting a certificate. If the CSR wasn't transmitted over HTTPS, since the Let

The CSR is signed by the key that is going to be used for HTTPS on the website requesting a certificate. If the CSR wasn't transmitted over HTTPS, since the Let's Encrypt CA has no idea what your key is, a network adversary could replace your CSR with one containing an attacker-controlled key.