I havent used Lets Encrypt, but other CAs would validate the owner of the TLD by sending an email to hostmaster. You wouldnt be able to have certificates issued on a subdomain unless you are verified as owner of the TLD. Is this not the case here, and if not, why not?