> HTTP-based ACME verification also uses unencrypted port-80 HTTP

I mean, they need to bootstrap the verification somehow no? You cannot upgrade the first time you request a challenge.