Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case.
>I have yet to hear any useful reason to rotate the key. http://security.stackexchange.com/questions/85963/what-is-th...
Basically limiting damage in case of a compromise.
All in, the Lets Encrypt way brings you more security. Since the certificate validity is shorter, even generating an extra certificate will give the attacker a smaller average time with a valid cert than stealing your StartSSL cert.
Another side-effect is that you don't need to manage revocation stuff as diligently, because certificates automatically expire shortly. The window during which a certificate is valid is extremely short and recent, which means there is less chance that a problem happens. when that probability increases (as a result of being older), certificates become automatically invalid.
Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like.
I don't consider this a positive thing.
You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way.
I have yet to hear any useful reason to rotate the key.