ACMs roots are cross-signed by Starfield (GoDaddy iirc), while they wait for their inclusion in the browser roots... so I can&#x27;t see a difference with LetsEncrypt? AFAIK either you have the processes&#x2F;tech in place to secure your CA and issue certificates, or you don&#x27;t.<p><a href="https:&#x2F;&#x2F;mozillacaprogram.secure.force.com&#x2F;CA&#x2F;PendingCACertificateReport" rel="nofollow">https:&#x2F;&#x2F;mozillacaprogram.secure.force.com&#x2F;CA&#x2F;PendingCACertif...</a> shows Mozilla&#x27;s in-progress certifications -- including LetsEncrypt, Amazon, DocuSign, VISA, a bunch of governments, telcos, existing CAs, and others I don&#x27;t recognise. Cross-signing is a pragmatic solution for older client devices (eg. abandonware Android phones) for _any_ CA root, new or otherwise.