> How can you use the same signer when the signer's keys are lost?
You mean, hypothetically if Letsencrypt suddenly loses the ability to sign new requests from me?
Well, then I have around 30 days to detect that and choose a new signer.
> Or, if the signer's keys are compromised, how do you switch to a non-compromised signer without alarms triggering?
Again, to be clear, you're talking about Letsencrypt's own signing keys in this case, being compromised and them being denied access to them. That seems incredibly unlikely to have both failures at the same time, but again: I have 30 days to find a new signer.
> The problem is almost exactly the same as one with a delegated CA -- if the CA keys are compromised
No! In fact, if Letsencrypt sublicenses signing to a third-party that certificate would be considered separate and so the switcheroo would be detected!
> When the client pins the CA key then the chain of trust is permanently broken
That's why it is important to extend TLS to allow multiple keypairs and certificates to be used to mutually authenticate the session key, so that any of the previous pinned keys can be used to update the pin. I did not say I wanted this for no reason!
You mean, hypothetically if Letsencrypt suddenly loses the ability to sign new requests from me?
Well, then I have around 30 days to detect that and choose a new signer.
> Or, if the signer's keys are compromised, how do you switch to a non-compromised signer without alarms triggering?
Again, to be clear, you're talking about Letsencrypt's own signing keys in this case, being compromised and them being denied access to them. That seems incredibly unlikely to have both failures at the same time, but again: I have 30 days to find a new signer.
> The problem is almost exactly the same as one with a delegated CA -- if the CA keys are compromised
No! In fact, if Letsencrypt sublicenses signing to a third-party that certificate would be considered separate and so the switcheroo would be detected!
> When the client pins the CA key then the chain of trust is permanently broken
That's why it is important to extend TLS to allow multiple keypairs and certificates to be used to mutually authenticate the session key, so that any of the previous pinned keys can be used to update the pin. I did not say I wanted this for no reason!