[zobzu]

They don't provide an EC or DSA CA (only RSA) you are limited to 1 domain + 1 alt name (the main domain) per cert

Those aren't horrible trade offs tho, but yes, those are limitations.