kube-apiserver tls certificate

Hey, is it possible to deploy k0s using k0sctl so that all kube-apiserver instances in the cluster use the same certificate in tls-cert-file, like in RKE1, or have the CA included inside tls-cert-file, like in RKE2?
If I deploy k0s using k0sctl, all kube-apiserver instances use unique certificates for TLS on port 6443.

I want to generate a kubeconfig with an OIDC JWT token and use the "certificate-authority" from the kube-apiserver on port 6443, but the kube-apiserver certificates are different from one another.
I end up getting an x509 error when I try to use the kubeconfig to access the API through a round-robin load balancer.

The issue names no files, tests, or entry points. Start by locating k0sctl's kube-apiserver certificate generation and kubeconfig CA handling, then verify the behavior across multiple API servers. Done means a kubeconfig using the API server CA works through a round-robin load balancer without an x509 error.

Written by the indexing model from the issue text.