Fortunately, that’s not how it works.

The private key is created on your server, not by Let’s encrypt, and it’s never transferred to them. Nobody can decrypt your data.

Certbot (the official ACME client) is open source, but you’re also welcome to use any other client of your choosing, or make your own. The secrets never leave your server.

Unless the NSA has working powerful quantum computers that can break public key encryption, that they are successfully hiding from the public, they wouldn’t be able to break let’s encrypt certificates backed public key encryption, the math just doesn’t math. It would still take the most powerful super computers millions of years to break RSA 2048.

There’s a reason they want to make encryption illegal, instead of just letting us trust it like sheep. Thankfully, we don’t have to trust anyone, it’s all verifiable math.