Why does goca insist on a CSR at all, if the template overrides everything in it? Because the CSR does one job nothing else can: it delivers the subject's public key, with proof of possession — and it does that job without the private key ever leaving the requester's machine.
Look back at the test issuance in frame 14: openssl generated the keypair locally, the CSR carried the public half, and goca returned certificatePem. At no point did the CA receive, see, or store the private key. That is not an implementation detail — it is the boundary that makes a CA trustworthy. A CA that handles subscriber private keys is a CA whose compromise leaks them.
The manual allows itself exactly one designed exception: EST server-side key generation, which would return a key only through its protected protocol response — and the EST head is roadmap (frame 54), so today the rule holds without exception: your keys are generated where they will live.
profile on the request is leaf (the default) or sub-ca; the template controls the resulting content, as the previous frame established.
Now I can explain why the CA never sees my private key — and why that's the point of the CSR.