When using a KMS key as the private-key, How is the signing-certificate generated?

The documentation from [here](https://docs.aws.amazon.com/de_de/enclaves/latest/user/cmd-nitro-build-enclave.html) says that a KMS key arn can be used for the private-key and [this documentation ](https://docs.aws.amazon.com/de_de/enclaves/latest/user/set-up-attestation.html#pcr8) says how to generate a signing-certificate from a local private-key. But what is the process for generating the signing certificate when using a KMS key for the private key?

Is this feature only supported for customer managed keys CMK, where we already have access to the private-key?

Start with the linked Nitro Enclaves build and attestation documentation, then trace how the private-key KMS ARN is handled. Clarify whether a signing certificate can be generated with KMS-backed keys, including the customer-managed-key question. Done means the documentation states the supported key types and the complete certificate-generation process or limitation.

Written by the indexing model from the issue text.