If you have to authenticate the domain every time, there's a good chance you capture that specific HTTP request traffic and log it to another server which isn't compromised. You now have an audit trail of the cert being issued and you have a chance of catching it.

If the account_key "walks away" and within 90 days they can get a cert without anything hitting your server, you have no audit log of the certificate being issued and are less likely to know your TLS is owned.

So if I understand correctly, the account_key is an unnecessary risk with very little return. (see my other post). I just immediately delete it every time, I don't see the point of keeping it.

Even key revocation does not require the account key, just the certificate private key. So really, what is the point? Unless there's something you actually need the account_key for... I feel like this was a failure to KISS.

EDIT: Mentioned downthread, there are also Certificate Transparency logs which can help you catch an unauthorized issuance, but that's not going to let you wire up an instant SMS through Twilio on every domain validation.