This is a really good point that I was missing. I kind of assumed that when people talked about the difficulty of de-issuing certificates, they just mean that companies would be slow to do it.

The fact that there is no central point of authority by default that can say "no, it's not good anymore" -- that changes a lot of things, because now your expiration date is effectively the only good way to get rid of the certificate.

That puts LetsEncrypt's 3 month model in a different light -- it's not just aggressive to force people to automate the renewal process, 3 months is literally just way better than a year for security purposes.