Proving any or all identifier for certificate revocation

[cpu]

@bruncsak

The problem is, when you get back the control of your own domain you may not be able to revoke the certificate (assuming you do not have the key of the certificate, neither the account key), if the attacker was smart enough to add a “guard” domain name into the certificate which he owns.

This situation would meet the bar for administrative revocation by Let's Encrypt.