...
(2) include the self-signed csr generated from the private key when enrolling new user with the fabric CA client;
see /test-applications/javascript/CAUtil.js
(3) build endorsement with transaction payload proposal and sign using the encryption algorithm corresponding to the private key
...