What would be great is the equivalent of the ACME protocol for cloud service providers. That will take a while and shouldn't happen until the offering matures and stabilises. But in an ideal world you wouldn't tie your application to a specific cloud provider. You should be able to lift and shift to another provider.
Which I think is a merit of using VMs as opposed to individual services.
But in an ideal world you wouldn't tie your application to a specific cloud provider.
You can do that easily if you just treat clouds merely as hosted hypervisors and think entirely in terms of VMDKs. But this doesn't make commercial sense to do at least in the short term - you need to utilise the layered services you are paying for anyway or you might as well just run your own DC.
It still makes sense for its elastic properties (from which EC2 got its name). You can't rent half a DC for an hour, but you can spawn generic instances from VMDKs on different providers with a fairly small abstraction layer.
Developped by let's encrypt, which helps solving the too big to fail problem with CA. When CA adopted it (which looks like it may happen), you will have a common protocol to create and renew certificates across CA.
Which I think is a merit of using VMs as opposed to individual services.