Which certificate and key does Kubernetes use to sign CertificateSigningRequests?

Question

I was trying to automate the process of signing Kubernetes certificates for new users.
The official documentation (here) suggests using Kubectl. In particular they sug