Does it deal with the case of SaaS apps for customer domains? Eg. Customer example.com rocks up to my SaaS app and wants to use myapp.example.com - currently creating
Yes. As the service provider, you can create a DNS record to verify "myapp.example.com", which is sufficient to get a certificate issued for it.
For a setup like this, you may still be better off getting a single wildcard certificate for "*.example.com", which (as far as we know currently), isn't possible through Let's Encrypt. But it's certainly possible to get these certificates through Let's Encrypt.
