The Let's Encrypt upcoming features page lists the following:
Multi-Perspective Validation
Currently Let’s Encrypt validates from a single network perspective. We are planning to start validating from multiple network perspectives.
I haven't been able to dig up any good information on this.
What is Multi-Perspective Validation?
This will help to protect against BGP Hijacking attacks.
During a BGP hijacking attack, the attacker can re-route the traffic though its own servers, allowing him to perform a MITM attack.
This allows him to create malicious responses to the challenges, which will be accepted by Let's Encrypt, and a certificate will be issued to the wrong person because of this.
Because of the lack of effort to fix BGP despite attacks being committed since a long time, Let's Encrypt plans to test a solution named Multi-Perspective Validation.
Using multiple independent networks to perform the validation will require an attacker to hijack more routes than before, thus raising the cost of a successful attack.
Their server connects to your HTTP server and/or to your authoritative DNS server (depending what kind of validation you choose to use) from multiple different data centers connected to the internet backbone through different Tier-1 ISPs.
Imagine they host their own servers in multiple cloud regions and require 9 confirmations from (AWS, GCP and Azure) by (N. America, W. Europe, E. Asia).
The advantage is that hijacking the network connection between the CA and the origin server is much harder, so a network attacker has to work harder to get the CA to issue a certificate to them.
