Certbot issues ECDSA key signed with RSA

[rg305]

@fzp

What am I doing wrong?

You've haven't read the entire announcement:

@fzp

According to the announcement:

You only mention one line [which is correct] and have taken it out of context.
The context for it is in the preceding sentences:

@jillian

With a production allow-listed account, all requests for certificates with ECDSA keys will be issued from our ECDSA hierarchy. There will not be a way to get an RSA certificate for an ECDSA key, nor vice versa; the way to control which issuer you get is to control what kind of key you generate locally.

• With a production allow-listed account
  [something you don't yet have & certbot 2.1.0 doesn't provide]
  [certbot 2.1.0 only defaults to ECDSA leaf - no longer RSA leaf]

Until then, you (and the rest of us) will receive what production provides:

• RSA signed RSA leaf
• RSA signed ECDSA leaf

Unless you are using a testing/staging cert:

@jillian

ECDSA issuance is available for all Staging accounts and can be used for testing.

[note: production and staging accounts are separate - not interchangeable]