[bracewel]

That's the relatively simple case, but there are a number of corner cases that make the process much more complicated.

See https://github.com/letsencrypt/acme-spec/pull/97 for a discussion of why this was scraped from the ACME specification proposal.

[0x0]

I don't get it. Whoever controls the base domain could always just replace the NS records and point any subdomain wherever.