Hacker News Reader

Because Let's Encrypt is the CA that hands out certificates without actually verifying identity.

If you set the CAA correctly, then letsencrypt will limit validation to the dns method. Together with DNSSEC that is enough to prevent issuing certificates in case of a route hijack.

Reply on news.ycombinator.com