Ask HN: Is Let's Encrypt the new swiss crypto ag?

From my understanding of the certificate transparency program does not mitigate the threat of them simply not disclosing a certificate they signed. Ultimately this still gives them MitM capabilities as long as they control the traffic or am I mistaken?

Actually some (popular) CA's can generate the cert on their side and let users download it. Not allowing this insecure practice is one more point in which LE is ahead of the curve.

During normal certificate issuance, they do not generate or see the private key, so they can't compromise the certs they sign for you.

Like any other CA, they do have the technical ability to sign arbitrary other certs, so could issue a cert for MITM. As some other comments show, certificate transparency is starting to reduce this risk.

Would be trivial except for the fact that they don't issue certificates.

Because I want to use LE and not other CAs.

The 'law' is more of an observation and generally applies to headlines. I feel you are being overly dismissive, as a question is being asked is in a dedicated section. There have been instances of CA's, most notably Symantec, which have turned out to be bad apples. There is a constant stream of news dispelling myths surrounding seemingly reputable firms regarding encryption/privacy. Whether these incidences are related or not, discussions like these need to be afforded a lot more leeway than most, and fleshed out, rather than being stifled.