Malware isn't the problem - their automagic client screwing up my webserver is the problem. This is a justified concern given that the official client already demonstrates bad behavior by causing side effects on --help (see my top level post).
Script crashed while trying to verify, left the apache config files in the modified state.
Trying to get that back to work took another half hour of the server being down.
I’m gonna use the simple website someone made to generate certificates from now on.