Because this happened:<p>&gt; Website owners should ensure that they secure their own website control panels, to ensure that new subdomains beyond their control are not created without their knowledge.<p>You&#x27;re a bank and haven&#x27;t secured your DNS control panel correctly. Someone comes along, and using your vulnerable DNS, registers logon.bank.com (instead of login.bank.com). Now it is the bank&#x27;s fault to begin with, but end-users are going to see that green padlock and will get pwned. You can point fingers all you want at the bank but that situation could (and should) have been avoided.<p>Let&#x27;s Encrypt could be seen as a &quot;vulnerability amplifier.&quot; With the previous PKI, even if you gained authority over logon.bank.com you wouldn&#x27;t be able to get that green padlock in the title bar. There is a very good chance that someone at the CA would have made a phone call to someone at bank.com. With the current Let&#x27;s Encrypt approach this scenario becomes plausible because no check is made with the parent domain to find out exactly how paranoid it is about subdomains.<p>Nobody is blaming Let&#x27;s Encrypt, but they can help.