The SPI certificate authority was never a public one. It was only used to sign Debian sites (and the majority of those have certs issued by Gandi these days; I think it's just debconf.org left).

So StartCom's non-commercial restriction is fine, and Let's Encrypt's DFSG-compliant script is fine. (Frankly, they're not even relevant for the use case of replacing the SPI CA, because Debian can just pay for certificates. If there's somehow a problem with funding, which I don't think Debian has at this scale, I'm sure there are countless people who would be thrilled to donate some money.)