This is a good example of what can go wrong when you try to use too much cryptography. When designing a protocol/application, you should first try to do it without crypto, then with hashes/symmetric crypto, and only as a last resort public key crypto (e.g. signatures, RSA), since the more crypto you use the more things can go wrong.

Here, ACME was using signatures for its challenges when it could have gotten by with no crypto at all (just putting the account ID and CA name in the challenge would have been secure, and easy to analyze) and got tripped up by a counter-intuitive property of signatures (signatures do not uniquely identify a person).