> ISRG may disclose Private Recovery Information, however, if compelled to do so by court order or other compulsory legal process. If possible, ISRG will give You notice of the potential disclosure and an opportunity to contest it.

this is what I expect, but then they also write

> ISRG may also disclose your PRI if it believes disclosure is necessary to prevent loss of life, personal injury, damage to property, or significant financial harm.

To me that sounds like an easy backdoor for corporate interests (significant financial harm) or law enforcement to bypass court orders. Isn't the legal process there in the first place to ensure that such claims are truthful?

Granted, PRI seems to be about email addresses and phone numbers [possibly more? the text says "such as"], but getting disposable phone numbers is not that easy in some countries.

One thing to emphasize about the PRI is that (perhaps differently from what you might be used to with some domain registrars or certificate authorities), the PRI is always optional for Let's Encrypt, and is used only in case of a problem such as losing your private key. You don't have to provide the PRI in order to get a cert, and this isn't a backdoor effort to require people to give a legal name in order to get a cert.

Having a working e-mail address is really valuable as a recovery mechanism -- but if you're very confident you won't need that and you don't want to give contact information, you need not do so.

Disclose to whom? To anybody?

"If it believes" – it's impossible to disprove that someone holds a certain belief. (Can a person who is a non-human corporation even hold beliefs?) Maybe this should say something about "reasonably expect" or something along those lines, something that can be argued about if there is disagreement?

As for financial harm, if I were to run a successful business on my domain, wouldn't my success in attracting customers be doing financial harm to my competitors?

But, of course, IANAL!

I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.

But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.

Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.

Also, seizure and hijacking aren't equivalent.

Anyway, it's trivial to find out whether a domain was expired and re-registered. The date of initial registration in the whois will change, so you can just compare it with the value you saw when you first issued a certificate for that domain.

I would. Especially if they refused to cooperate with the US gov't.