In CNO we have an approver that signs certs automatically, without checking any identity information. We should modify this to require that the certificate request contains the kubelet certificate (issued separately) to ensure the identity of the client is an openshift node. We should not just hand out certificates to anyone who asks for them.