Hm. Let's Encrypt's FAQ tells me I'm on the right track with that question but the distinctinos are far more coarse than I was worried about:
Does Let’s Encrypt issue certificates for anything other than SSL/TLS for websites? Let’s Encrypt certificates are standard Domain Validation certificates, so you can use them for any server that uses a domain name, like web servers, mail servers, FTP servers, and many more. Email encryption and code signing require a different type of certificate that Let’s Encrypt does not issue. So it sounds like, at least for SSL connections, we should use the same certificate authorities used to authenticate web sites. If ever we implemented signed extensions, for example, it might require different certificates -- I don't know what that means for the SSL validation rules and the storage for them.
