Create a CSR
- Private key is provided directly
- Private key is generated on demand
- [?] Private key is stored in a secret
Uses Go-odness to load the private key, maybe derive the public key, generate and sign (?) own CSR.
- What about EC?
- Should we parametrise the kind of key the app wants?
- What about hardware devices --> pass public key, not private key?
- Or, perhaps, have the hardware generate the CSR and pass that?
- Poison? WAT?