I'm a bit confused about the "non-root support" -- the (somewhat lengthy) setup manual absolutely seems to require root to set up users and directories in the root filesystem.

In contrast, the official client can absolutely work without having root access. You can install it locally (pip install --user letsencrypt) and change all working directories to paths your user can write to using a configuration file.