Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

1.9

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

What did you do?

Read documentation at https://godoc.org/golang.org/x/crypto/acme/autocert#Manager.

What did you expect to see?

Regarding the Client field, I expected the behaviour here:

client := m.Client
if client == nil {
	client = &acme.Client{DirectoryURL: acme.LetsEncryptURL}
}
if client.Key == nil {
	var err error
	client.Key, err = m.accountKey(ctx)
	if err != nil {
		return nil, err
	}
}

To be documented, with something along the lines of:

// If Client is nil, a zero-value acme.Client is used with acme.LetsEncryptURL
// directory endpoint.
// Then, if Client.Key is nil, a newly-generated ECDSA P-256 key is used.

What did you see instead?

// If Client is nil, a zero-value acme.Client is used with acme.LetsEncryptURL
// directory endpoint and a newly-generated ECDSA P-256 key.

Note that the current documentation implies that:

m := autocert.Manager{
	Client: &acme.Client{DirectoryURL: "http://example.com"},
}

Is incorrect as the documentation for acme.Client states:

Client is an ACME client. The only required field is Key.

The autocert package helpfully generates a key for you and fills in the Key field, allowing you to specify an alternative DirectoryURL without having to generate a key yourself.