[nileshtrivedi]

It would just request LetsEncrypt to generate those certs and then prove the "ownership" (more like "control") of those domains by whatever method LetsEncrypt wants (.well-known perhaps?).

[Nullabillity]

Yup, .well-known should be pretty simple for them to implement.