You should support ACME.
Are the policy concerns you raise related to the above, or something else?
- user checks box that says they want certs issued automatically.
- your software handles the rest.
Of course there are plenty of details for the engineers to work out, but the end user shouldn't need to know any of them.
I was thinking that you were imagining that they would need to set up some kind of internal ACME infrastructure or something. Now I see you were just imagining certbot. Maybe half the domains I've seen used aren't actually publicly resolvable. Once I saw one that was, but was actually owned by someone else.
Anyway, there is no easy way out.