Sign using an ephemeral keypair and a short-lived certificate with OIDC identity. Uses OIDC identity token to obtain a 10' public-key certificate from Fulcio CA. Check for more info at Xygeni Docs (Subscription required)