Why not? Right now, compromised account keys give you the ability to issue certificates that are valid about as long as certificates are valid (or, in the worst case, +90 days from the original expiration date). Just about any scenario where the account key is compromised is one where the certificate's private key is compromised as well (not to mention typically one where you can just solve another challenge), so you're not really in a much worse position. Even less of a concern once authorizations are valid for only ~7 days.

> I've updated the blog post

You still state in your updated post that: "The surprising aspect is that Authz has a validity of 300 days (which is likely to be increased)" [emphasis mine]. This would appear to be incorrect based on the source cited above , where it is stated at "Eventually, we'd like to make authorization objects much shorter than certificate lifetimes, probably 7 days."

Perhaps it's worth updating the post again in light of this?

If you don't mind, I'd like to add to your blog post.

Token issues are something we solved about a decade ago. As to why LetsEncrypt has yet to learn these lessons, I leave that as an exercise to the readers and those familiar with security issues to discover for themselves.