HTTPS-only mode (is briefly mentioned and I recommend to LWN readers)

For a smaller employer (I currently work for a Russell Group university so, not us) I can see that it was inconvenient to do this with for-profit CAs even with some sort of agreed bulk purchase arrangement. But, Let's Encrypt was opened to the public almost a decade ago - I no longer see "But it was easier not to" as a sign of anything other than an outdated technology stack, it's like having telnet open in 2005. Sure, ten years ago this was a hard problem, but it got solved and it's about time you caught up to that.