I was thinking of disposable OS account and some ACME app that only deals with CSR and has no access to private key/doesn’t generate one. Is that an option?
I can google, but I am now over 18 hours without sleep, and it tells.
Or may be even disposable VM…