This involves removing creation of the MCS CA and signing key in the installer. It may be possible do this after https://issues.redhat.com/browse/MCO-1457, but it may have to be done in conjunction. Relevant(not exhaustive) code paths:

• https://github.com/openshift/installer/blob/master/pkg/asset/tls/root.go#L31
• https://github.com/openshift/installer/blob/master/pkg/asset/tls/serviceaccountkeypair.go
• https://github.com/openshift/installer/blob/043273942fdc1ebd8f9dd8d4423562b4ca149963/pkg/asset/ignition/machine/node.go#L64C1-L70C6