Should surface certificateAuthorityId more clearly in docs

[SpectralHiss]

This field is useful especially if following the advice on the first paragraph:

It is recommended to create subordinate CAs for signing leaf certificates. See the official documentation.

It requires a little bit of digging to look at config/crd/base to find the option, i believe it should be documented more clearly. perhaps the docs should point to complete api/crd docs with annotations/explanations.

I may have missed another place where this is documented, if so it should be linked more clearly in the README