>=2 certs/pk ; same name ; different services?

[Osiris]

@Ravedigger

My wording was for application compromise, not system compromise.

Usually applications cannot reach the certificate once it has been started. It's common to start an application as root so it can read the root owned private key and afterwards drop the privileges to a much lesser privileged user.

@Ravedigger

So LE Certs do not get revoked when a new one with the same name gets fetched, interesting.

Correct.

@Ravedigger

Which ACME challenges are existing and supported?

Those you've read in the docs.

@Ravedigger

So I essentially have to protect DNS and Port 80,443 on the addresses the name points to, to gatekeep issuance.

I don't know what you mean by this. It's quite common to have port 80 and 443 open. Look at all those websites out there using them. Or what do you mean by "protecting" and "gatekeeping" exactly?

@Ravedigger

How would I be notified if new ACME-challenges get enabled whose paths I may not have locked down for users/programs?

I don't think you have to "lock down" anything to begin with, but my bet is to follow the API Announcements category. That way you'll get an email on the address associated with your Community account when a new thread is opened there.

@Ravedigger

Can I tell LE to disable challenge types for my zone

You could use CAA RRs for that. See Enabling ACME CAA Account and Method Binding for more info about that.

@Ravedigger

Are there other free of cost CAs with DV other DV challenges that do not revoke same name issuances?

I'm not 100 % sure, but I'm not aware of any free CA revoking duplicate certs. See ACME CA Comparison - Posh-ACME for a comparison of ACME CAs.

@Ravedigger

Is there some established way to somehow cross-sign services using ones own CA that has stricter verification, so as to have own clients trust only that but still have certs publically trusted for others?

No, cross-signing is not an option for end users. Only for entities with lots of money willing to set up their own sub-CA for

@Ravedigger

Do I think the wrong way here and there is a really simple solution to that thought?

Personally I think you're overthinking this