Authenticate Static Public Keys

Question

How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the client's static public key to another node in the network??

Background context: The client and another node will both generate ephemeral ECC keys for a ECDHE key exchange. The ephemeral ECC public keys will be signed with the static ECC keys to prove the authenticity of the ephemeral ECC keys. But when the static ECC keys are generated and sent to the CA, how can their authenticity be proven??

Answer 1

If I understand you correctly you want to make sure, that the CA can verify that a public key submitted from some party actually belongs to this claimed party, i.e. it wants to be sure of the submitter's identity. This is not possible without having already some kind of direct or indirect trust relationship between CA and the party and your question does not provide any clue of what this trust relationship in your specific case might be.
Some examples:

• The party might give the key directly to the CA and show some kind of identity (passport, driver license...) which is considered a trusted identity by the CA because it was issued by a trusted instance (government or similar).
• The party might claim to be a specific name living at a specific address and the certificate (which is the signed key and additional information) should include such information. In this case the CA might send a letter to the given name and address and the party must prove that it received this letter (by providing its secret contents). In this case the CA would trust the postal service to deliver this letter only to the given address.
• The party might claim an identity associated with a specific domain name. In this case the CA might ask the party to prove ownership of the domain, for example by being able to receive mail for this domain (similar to the previous case, but electronic letter) or by being able to provide a specific content at a URL from this domain. In this case the CA trusts the domain name system (DNS). This kind of method is for example used for domain validated certificates.

Apart from that the party commonly proves not only that it has a specific identity but that it actually owns the specific public key. This is done by signing the key (and usually additional information) with the associated private key. This is for example done within a certificate signing request (CSR).