> I know that some people have said they don't like running a large new application as root, even when it's open source.

Certbot could be configured to run without root with little effort, at least the part exposed to the web that was my concern.