code: func digestedName(privateKeyData []byte, subject *pkix.Name, usages []certificates.KeyUsage) string {
  	hash := sha512.New512_256()
  
  	// Here we make sure two different inputs can't write the same stream
  	// to the hash. This delimiter is not in the base64.URLEncoding
  	// alphabet so there is no way to have spill over collisions. Without
  	// it 'CN:foo,ORG:bar' hashes to the same value as 'CN:foob,ORG:ar'
  	const delimiter = '|'
  	encode := base64.RawURLEncoding.EncodeToString
  
  	write := func(data []byte) {
  		hash.Write([]byte(encode(data)))
  		hash.Write([]byte{delimiter})
  	}
  
  	write(privateKeyData)
  	write([]byte(subject.CommonName))
  	for _, v := range subject.Organization {
  		write([]byte(v))
  	}
  	for _, v := range usages {
  		write([]byte(v))
  	}
  
  	return "node-csr-" + encode(hash.Sum(nil))
  }
docs: // This digest should include all the relevant pieces of the CSR we care about.
  // We can't direcly hash the serialized CSR because of random padding that we
  // regenerate every loop and we include usages which are not contained in the
  // CSR. This needs to be kept up to date as we add new fields to the node
  // certificates and with ensureCompatible.