Why is a CSR signed and which key is used for signing?
[Why] is the CSR istself signed?


The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ownership of the private key corresponding to the public key in the CSR.


  [Which] key is typically used?


The private key which is associated with the public key embedded in your CSR.