The plan is to have a new annotation (such as secrets.stackable.tech/provision-identity as a boolean or e.g. some other attribute with e.g. values public / private), which controls if you only get the public parts (ca.crt for tls-pem, trsustore for tls-pkcs12 and krb5.conf for kerberos) or all parts (as currently done).
For compatibility reasons we should probably default to only the private parts. In operator-rs the SecretOperatorVolumeBuilder needs to expose this new attribute, it IMHo should be made mandatory, so every product operators needs to make a call what exactly he needs.