Use the API to sign certificate signing requests from non-certificate authority nodes for Puppet Enterprise 2016.2 to 2017.1, 2017.3 to 2019.2

I'd like to use the API to sign certificate signing requests (CSRs) from nodes that aren't the Puppet Enterprise certificate authority (CA). How do I do that? Version and installation information P...