diff --git a/acme/acme/messages.py b/acme/acme/messages.py
index f1c32ad3b..f6b4aa3e5 100644
--- a/acme/acme/messages.py
+++ b/acme/acme/messages.py
@@ -316,6 +316,9 @@ class ExternalAccountBinding:
         return eab.to_partial_json()
 
 
+T = TypeVar('T', bound='Registration')
+
+
 class Registration(ResourceBody):
     """Registration Resource Body.
 
@@ -343,9 +346,9 @@ class Registration(ResourceBody):
     email_prefix = 'mailto:'
 
     @classmethod
-    def from_data(cls, phone: Optional[str] = None, email: Optional[str] = None,
+    def from_data(cls: Type[T], phone: Optional[str] = None, email: Optional[str] = None,
                   external_account_binding: Optional[Dict[str, Any]] = None,
-                  **kwargs: Any) -> 'Registration':
+                  **kwargs: Any) -> T:
         """
         Create registration resource from contact details.
 
@@ -679,9 +682,9 @@ class OrderResource(ResourceWithURI):
     body: Order = jose.field('body', decoder=Order.from_json)
     csr_pem: bytes = jose.field('csr_pem', omitempty=True)
     authorizations: List[AuthorizationResource] = jose.field('authorizations')
-    fullchain_pem: bytes = jose.field('fullchain_pem', omitempty=True)
-    alternative_fullchains_pem: List[bytes] = jose.field('alternative_fullchains_pem',
-                                                         omitempty=True)
+    fullchain_pem: str = jose.field('fullchain_pem', omitempty=True)
+    alternative_fullchains_pem: List[str] = jose.field('alternative_fullchains_pem',
+                                                       omitempty=True)
 
 
 @Directory.register
diff --git a/certbot/certbot/_internal/plugins/manual.py b/certbot/certbot/_internal/plugins/manual.py
index dc45ae271..6c69b7e5b 100644
--- a/certbot/certbot/_internal/plugins/manual.py
+++ b/certbot/certbot/_internal/plugins/manual.py
@@ -98,7 +98,7 @@ permitted by DNS standards.)
         super().__init__(*args, **kwargs)
         self.reverter = reverter.Reverter(self.config)
         self.reverter.recovery_routine()
-        self.env: Dict[achallenges.KeyAuthorizationAnnotatedChallenge, Dict[str, str]] = {}
+        self.env: Dict[achallenges.AnnotatedChallenge, Dict[str, str]] = {}
         self.subsequent_dns_challenge = False
         self.subsequent_any_challenge = False
 
diff --git a/certbot/certbot/_internal/plugins/standalone.py b/certbot/certbot/_internal/plugins/standalone.py
index f70d2ed9e..826acb2b1 100644
--- a/certbot/certbot/_internal/plugins/standalone.py
+++ b/certbot/certbot/_internal/plugins/standalone.py
@@ -30,7 +30,7 @@ logger = logging.getLogger(__name__)
 if TYPE_CHECKING:
     ServedType = DefaultDict[
         acme_standalone.BaseDualNetworkedServers,
-        Set[achallenges.KeyAuthorizationAnnotatedChallenge]
+        Set[achallenges.AnnotatedChallenge]
     ]
 
 
diff --git a/certbot/certbot/_internal/plugins/webroot.py b/certbot/certbot/_internal/plugins/webroot.py
index 3e4b19f13..4a84197b0 100644
--- a/certbot/certbot/_internal/plugins/webroot.py
+++ b/certbot/certbot/_internal/plugins/webroot.py
@@ -20,7 +20,7 @@ from certbot import crypto_util
 from certbot import errors
 from certbot import interfaces
 from certbot._internal import cli
-from certbot.achallenges import KeyAuthorizationAnnotatedChallenge as AnnotatedChallenge
+from certbot.achallenges import AnnotatedChallenge
 from certbot.compat import filesystem
 from certbot.compat import os
 from certbot.display import ops
diff --git a/certbot/certbot/plugins/dns_test_common_lexicon.py b/certbot/certbot/plugins/dns_test_common_lexicon.py
index df91dac1f..76c25881d 100644
--- a/certbot/certbot/plugins/dns_test_common_lexicon.py
+++ b/certbot/certbot/plugins/dns_test_common_lexicon.py
@@ -9,6 +9,7 @@ from requests.exceptions import RequestException
 
 from acme.challenges import Challenge
 from certbot import errors
+from certbot.achallenges import AnnotatedChallenge
 from certbot.plugins import dns_test_common
 from certbot.plugins.dns_common_lexicon import LexiconClient
 from certbot.plugins.dns_test_common import _AuthenticatorCallableTestCase
@@ -33,7 +34,7 @@ class _AuthenticatorCallableLexiconTestCase(_AuthenticatorCallableTestCase, Prot
     a mocked LexiconClient instance.
     """
     mock_client: MagicMock
-    achall: Challenge
+    achall: AnnotatedChallenge
 
 
 class _LexiconAwareTestCase(Protocol):