issuance that does not need the machine reachable
The ordinary way to obtain a certificate for a name is to let the outside world fetch a token from the address that name resolves to. It is the path with the fewest moving parts, and it assumed something that stopped being true: that the…