I wonder why there is a hash signed by private key in the CSR? It does prove that I have the private key that belongs to the public key in the .csr. But who cares whether I actually do possess the private key? The CA doesn´t need this proof for signing the CSR. It just signs the "Subject" data, some metadata and the public key.
Could you pls describe an Attack that would be possible if there was no signed hash in the CSR request?