I just read this article on Wikipedia: Certificate Signing Request
I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator.
What I don't understand is why the CA, which receives and processes the CSR, then removes this signature (I mean, without this signature a CA could possibly alter attributes of the CSR).
Why does a CA not just add the necessary attributes to the CSR and sign it with its private key?