well, the signed certificates are sent back to the workloads where they are then installed. To verify that they have indeed been signed by the Kubernetes CA, you need to first extract the signed certificates.</p><ol><li><p>Dump all pods running in the namespace.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl get pods -n bookinfo
</code></pre></li></ol><p>Pick any of the running pods for the next step.</p><ol><li><p>Get the certificate chain and CA root certificate used by 