web pki

Let's Encrypt enforces sanctions no browser checks

Let's Encrypt's sanctions restriction gates issuance by geography, not risk. The Web PKI validates by reference, so only the issuer field changes.