Use CSRs instead of generating PKs on the cloud side

[coderbyheart]

The security of the setup can be improved by signing a CSR on the cloud side instead of generating the key pair on the cloud side.

This is documented here: https://docs.aws.amazon.com/iot/latest/developerguide/provisioning-cert-provider.html

Blog post: https://aws.amazon.com/blogs/iot/aws-iot-core-private-certificate-authorities-with-fleet-provisioning/