As clarification: A poll for a new certificate could then be as simple as "sign the CSR with the key, do a POST to their URL with the CSR in the form data, get the results back".
Not necessarily – obviously, many other approaches would work, too – but having to run a webserver to get it approved, and move files around, etc, makes the process a bit bothersome if one wants to automate it without giving the script access to the webserver, or doesn’t want to run one.
EDIT: Obviously, I have to be missing something, right? What’s the error in my concept? I mean, if it was that simple, they’d have already implemented it.
DNS verification is already in the ACME spec, but not yet supported by the live servers. So the answer is "soon".
Maybe I could put a public key in DNS, sign the CSR with the private key, they’d poll the DNS for the key, verify, and approve it?
That would improve the ability to automate it for me a lot, without having to use a webserver.