Small ACME client written with process isolation and minimal privileges in mind