> Say we all move to HTTPS but then let’s encrypt goes away

Just switch to ZeroSSL - it's the default certificate provider for the acme.sh script now.