I trust them to maintain a secure CA (and I trust that there are adequate checks and audit mechanisms in place).<p>I do not necessarily trust them to not muck up my webserver configs, or to accidentally expose my private key due to some bug. While I have no reason to doubt the code quality of the official client (and I&#x27;m certainly not suggesting I suspect any malicious activity), I suspect the checks in place for the client are probably less rigorous than those for the CA itself.<p>acme-tiny is less than 200 lines. Short enough that reviewing the code took a trivial amount of time, and now I&#x27;m using a client that I can trust completely.<p>I could certainly do the same thing with the official client, but it would take me several hours (at least) to get to the same level of comfort.