The only mention of signing new certificates I see is serialize_*_with_signer functions.

I am expected to serialize, then immediately deserialize certificate even though there is no intention to save it to file or transmit.

Documentation may be more clear about why signing and serialization are one step. I expected there be something like rcgen::Certificate::from_params_with_signer(params: CertificateParams, ca: &Certificate), so I can sign certificate, then serialize it if needed (or use somehow directly).