How would you implement “strict checking” at scale and for free?
Given that in the end, Let's Encrypt/ACME relies on PoP of a DNS domain, DNSSEC setup on the domain should have been a prerequisite.
In addition, an explicit opt-in should be required, for example, with a requirement for a CAA record pointing to LE.
---
As a side note, this whole situation leaves me with a really weird feeling.
On one end, I will always be grateful for LE enabling tls/https generalization.
On the other, I kind of feel betrayed and/or ashamed that LE/ACME almost willingly introduced protocol flaws weakening the whole CA infrastructure and that we (me included) didn't challenge it more when LE was introduced.
Thanks to widely available HTTPS certificates, "evil hackers stealing your cookies on public Wi-Fi" is not a thing anymore.
We should definitely have a discussion about whether it's made active attacks more feasible, but I think the goal of making passive sniffing less trivial than it was before can be considered achieved.