It's true you can really DOS your own site if you don't follow best practices or have catastrophic data loss. Same with HSTS if you ever need to go back to HTTP.

On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use.

I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet.

Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.