I have got a master node up and running, and want to run another master.
I use the following join command:

  kubeadm join 127.0.0.1:8443 --token <token> 
    --discovery-token-ca-cert-hash <sha> 
    --control-plane --certificate-key <key>

During join, both parties should trust each other. Sha is used to verify api-server certificate. Token is used to authorize new master. After authorization, new master can issue csr in order to get his certificate.
Certificate key is used to decrypt certificates from master node(stored in secret).

My question is, what certificates exactly key is supposed to decrypt?