Comment by jyounker

There is only one public key that installed on the servers. That key is the same everywhere. You have a self-serve system that generates short-lived certs to users.