Let’s Encrypt now requires certificate subscribers to confirm they are not covered by comprehensive U.S. sanctions or restricted-party rules.