I considered that, but was hoping to avoid spreading the ACME credentials around, especially since they can be used to revoke certificates in addition to requesting arbitrary certificates. We'll be running this on all of our web and database servers, plus some Windows systems (AD, some other systems needing RDP)