[tehbeard]

> It seems unworkable for the majority of smaller sites who are increasingly forced to use letsencrypt.

It's one line in a crontab, hardly an enterprise level endevaour involving IBM consultants and a triple redundant K8S cluster.

> Unless you want that automatic update tool on your server, which I find a bit sketchy.

It's no sketchier than you using binaries from your distro's repo, or even the Linux kernel. I doubt you'd read either line by line to check for nefarious wrong doing.