Private Diffie/Helman Tokens

Let's Encrypt also checks that whoever requests a certificate appears to control the domain from multiple endpoints in different countries. So it is at least harder for an attacker to intercept all of Let's Encrypt's viewpoints than it is to intercept your single viewpoint.