I’m not shy to say that if acme-client can be modified to not require access to private keys at all, that would be a welcome improvement.
But you described privilege separation as “real men programming,” and that’s off base.
I am (sincerely!) interested in what Let’s Encrypt clients you suggest that use http-01 and don’t require access to private keys.
I haven’t looked at the OpenBSD code but have built a system that uses a separate server to actually perform the certbot http challenge. The server needing the certificate just forwards the port 80 acme requests to the certbot server
CSRs were sufficient for that, at no point was it necessary to ship private keys. And this was using just the standard ubuntu certbot for the actual requests.
There should be no need for your ACME client to have access to those private keys in the first place. That's what I'm highlighting.
If pledge works 100% in OpenBSD and if the acme-client C code is bug-free - neither of which is likely much less certain - then it's exactly as safe in this respect as a dozen other ACME clients using CSRs otherwise it's worse.