You appear to have been hit by a recently discovered issue - see LetsEncrypt Overwriting Root Server Keys