There&#x27;s an authority delegation problem where &quot;example.com&quot; wants to delegate &quot;adblaster.example.com&quot; to some ad service.  The owner of &quot;example.com&quot; needs to approve this, but the party named in the certificate is not &quot;example.com&quot;, but the AdBlaster service.<p>On the other hand, since this feature is used almost solely for advertising, there&#x27;s no reason Let&#x27;s Encrypt should offer this service for free.  Let the ad guys buy those certs from Verisign and verify them with both parties manually.