External jwt signer

This is sort of continuation of my question from the other post

I get identity from internal CA, I can use that identity to request a oidc access token from my CA. If I could use that for enrolling router ( where controller verifies the token with my CA as oidc provider ), I was thinking I could avoid doing “ziti edge login …” for router enrollment.