I thought so too . Since the skins cost $ 10 each . What do you think about the look of the skins ? <| sep |> Reminds me of thisB 89 PswUL 4 fY <| sep |> This doesn ' t really work . The CA doesn ' t hold or control the private key of your certificate . If the CA gives you a certificate that doesn ' t match your private key which , again , is generated by the client and only known to you , it won ' t work . At best , this could be used as a DoS , though even that could be prevented by a client check does the public key in the certificate match the known private key and does it chain up to a trusted root ? . If you assume that the client is compromised through an update with a backdoor and would play along , well , how do you know a different component like your web server won ' t do the exact same thing ? Your ACME client probably even uses the same software distribution method apt or yumdnf , so you ' re not really trusting anything new .