How would they get the private key? Or would this CA only allow using certs with private keys they generated instead of using CSRs?