Comment by wejn

Because:

1. ACME is a dumpster fire prone to mitm attacks.

2. without HSM (an additional investment) it's super bad idea to host your root CA signing key somewhere.