Actually some (popular) CA's can generate the cert on their side and let users download it. Not allowing this insecure practice is one more point in which LE is ahead of the curve.