I am new to Salesforce DX and am in the process of setting up a scratch org. The steps on Salesforce's website instruct the user to create a self-signed certificate because "The JWT-based authorization flow requires first generating a digital certificate and creating a connected app."
I am referring to this site: https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_jwt_flow.htm
Basically it says "Do this is you want to make it work" but it doesn't really explain the implications of using a self-signed certificate. Presumably this means that the private key will need to be shared with the developers so they can create scratch org's as needed.
As a best practice, self-signed certificates are usually a bad idea. Combine that with the fact that multiple developers have access to the private key and it seems like a potential risk to the production instance. If Salesforce is told to trust any JWT token signed with the private key of a self-signed certificate and that private key were to be compromised (uploaded to a public GitHub for example), would that allow an attacker to create fake JWT tokens or otherwise compromise our security?
I haven't been able to find any best-practices regarding this either so any info would be much appreciated.