All it takes is 5 (or 20?) users to delete their accounts and you've used up your Let's Encrypt quota for the entire week!
Without wildcard certificates or a method to remove subdomains from a certificate, LE is still useless for UGC sites with per-user subdomains.
1. There is no way to remove a domain from an existing certificate. Changing a certificate in any way always results in a new issuance. That's just how certificates work, nothing specific to Let's Encrypt. Certificate issuance cannot be scaled to infinity, so the same limit has to apply here (otherwise anyone could just bypass the rate limit by adding and removing subdomains and launch a DoS that way).
2. The relevant rate limit here would be 20 per week, not 5. (5 is for completely identical domain sets, i.e. duplicates)
3. Do you revoke the certificate after reissuing it without the subdomain (i.e. because it's a delegated domain and your user explicitly wants to remove trust)? If not, you might as well keep it around until your next renewal of that particular certificate and remove it at that point.
That does seem like the best workaround for now. Idealy in the future I hope we can synchronously make a LE API call on the spot instead of having to manually manage a revocation queue.
You're right that the default tooling would not work quite the way I described, but this use-case seems to call for a more low-level ACME library anyway, and with that it should not be too complex to implement some kind of bucket system where you just split your subdomains in buckets of 100 each, and occasionally rebalance them as subdomains are removed (i.e. merge two buckets into one when they have less than 100 subdomains total, etc.)
Let's Encrypt is a public service, aimed at operators of individual systems who host web content or email in a casual sense, were poorly served by the complexity of getting and maintaining a TLS cert, and who empirically were basically not doing TLS.
Your posited blog host is going to be a professional or semi-professional web admin. Just call up Comodo or whoever. There's a product for that need. Let's Encrypt is not it.
In the vernacular: cry me a river.
As a webhost we have offered SSL certificates to customers for ages. Unless it's free you will see very little uptake. Which eliminates the main purpose for LE to exist, from what I was told.
I also have a rather compelling use case for far more than 20 subdomain certificates a week, but there is absolutely no "market" for that use-case - it simply increases Internet security. Which was the entire stated goal of the project, I thought.
First I've heard that LE is only for personal use :)