h related signer info. Istiod forwards the CSR request to the custom CA for signing. The custom CA will use the correct cluster issuer to sign the cert back. Workloads under <code>foo</code> namespace will use <code>foo</code> cluster issuers while workloads under <code>bar</code> namespace will use the <code>bar</code> cluster issuers. To verify that they have indeed been signed by correct cluster issuers, we can verify workloads under the same namespace can communicate while workloads under the different 