Point 3 is being addressed in v0.16.17 ACME Providers Are Indistinguishable in Domain TLS Settings - #3 by stalwart but I would still request that a global ACME provider option be created so we can share one with the same properties against multiple tenants.