docs: add PKI configuration documentation to customization guide

Document the configurable PKI feature in docs/user/customization.md,
following the existing inline documentation pattern for install-config
properties.

Key additions:
- Add pki field entry with nested signerCertificates structure
- Add RSA 4096 and ECDSA P-384 install-config example fragments
- Document ConfigurablePKI feature gate requirement
- Note scope: signer certificates only, leaf certs unaffected

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

docs/user/customization.md

@@ -54,6 +54,16 @@ feature set.
         The default is [OVNKubernetes][ovn-kubernetes].
     * `serviceNetwork` (optional array of [IP networks](#ip-networks)): The IP address pools for services.
         The default is 172.30.0.0/16.
+* `pki` (optional object): Configures cryptographic parameters for installer-generated signer certificates.
+    Requires the `ConfigurablePKI` feature gate (set `featureSet: TechPreviewNoUpgrade` or use `CustomNoUpgrade` with `featureGates`).
+    When omitted, all signer certificates use RSA 2048 (existing default behavior).
+    * `signerCertificates` (optional object): Overrides key parameters for all signer certificates.
+        * `key` (optional object): Key generation parameters.
+            * `algorithm` (required string): The key algorithm. Valid values are `RSA` and `ECDSA`.
+            * `rsa` (optional object): RSA-specific parameters. Required when `algorithm` is `RSA`.
+                * `keySize` (required integer): Key size in bits. Valid values are multiples of 1024 from 2048 to 8192.
+            * `ecdsa` (optional object): ECDSA-specific parameters. Required when `algorithm` is `ECDSA`.
+                * `curve` (required string): The elliptic curve. Valid values are `P256`, `P384`, and `P521`.
 * `platform` (required object): The configuration for the specific platform upon which to perform the installation.
     * `aws` (optional object): [AWS-specific properties](aws/customization.md#cluster-scoped-properties).
     * `baremetal` (optional object): [Baremetal IPI-specific properties](metal/customization_ipi.md).
@@ -251,6 +261,48 @@ sshKey: ssh-ed25519 AAAA...
 If your proxy certificate is signed by a certificate authority which RHCOS does not trust by default, you may also wish to configure [an additional trust bundle](#additional-trust-bundle).
 If `additionalTrustBundle` and at least one `proxy` setting are configured, the `cluster` [Proxy object][proxy] will be configured with [`trustedCA`][proxy-trusted-ca] referencing the additional trust bundle.
 
+### PKI (signer certificate configuration)
+
+An example install config with RSA 4096-bit signer certificates:
+
+```yaml
+apiVersion: v1
+baseDomain: example.com
+metadata:
+  name: test-cluster
+featureSet: TechPreviewNoUpgrade
+pki:
+  signerCertificates:
+    key:
+      algorithm: RSA
+      rsa:
+        keySize: 4096
+platform: ...
+pullSecret: '{"auths": ...}'
+sshKey: ssh-ed25519 AAAA...
+```
+
+An example install config with ECDSA P-384 signer certificates:
+
+```yaml
+apiVersion: v1
+baseDomain: example.com
+metadata:
+  name: test-cluster
+featureSet: TechPreviewNoUpgrade
+pki:
+  signerCertificates:
+    key:
+      algorithm: ECDSA
+      ecdsa:
+        curve: P384
+platform: ...
+pullSecret: '{"auths": ...}'
+sshKey: ssh-ed25519 AAAA...
+```
+
+The `pki` configuration applies only to the 10 signer (CA) certificates generated by the installer. Leaf certificates signed by these CAs continue to use RSA 2048. When `pki` is present, `signerCertificates` must be fully specified with algorithm and key parameters.
+
 ## Kubernetes Customization (unvalidated)
 
 In addition to customizing OpenShift and aspects of the underlying platform, the installer allows arbitrary modification to the Kubernetes objects that are injected into the cluster. Note that there is currently no validation on the modifications that are made, so it is possible that the changes will result in a non-functioning cluster. The Kubernetes manifests can be viewed and modified using the `manifests` and `manifest-templates` targets.