SigningKey

Issue a certificate for an arbitrary subject/SAN signed by the CA's key.

Rewrite the CA resource policy to grant self issuance, then sign as the CA.

Issue a SubordinateCACertificate to create a new issuer chaining to the trusted CA.

A CU with wrap rights can wrap an EXTRACTABLE key out of the HSM for offline use.

A CloudHSM CU credential (with VPC reach) can sign with the HSM private key.

Signing with a key that anchors an auth system forges the trusted identity.

Admin of a SIGN_VERIFY key can self-grant kms:Sign and forge signatures.

The B2C IEF Keyset Administrator can replace the signing keyset used by custom policies, enabling token forgery for all relying party applications.

Key Vault Administrator can sign with every signing-capable key in the vault.

A vault self-grant equally yields sign on every signing-capable key in the vault.

A Managed HSM local Crypto User role can sign with an HSM signing key.

Possession of the security domain + quorum keys can clone all HSM keys to a new pool.

Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.

A cert signed by the CA authenticates as the subject/SAN it names to a consuming trust.

Issue a cert for an attacker-chosen subject/SAN that a downstream trust accepts, impersonating that identity.

A principal that can execute as a workload SA holding certificateRequester can issue certs.