Why would I download CA certificate when starting a managed Postgres cluster on DigitalOcean?
You can use it with TLS to verify that you are connecting to the correct server.
The connection string for that would look like:
host=... port=... dbname=... user=... sslmode=verify-full sslrootcert=/path/to/ca-certificate.crt

If you cannot specify the connection string that way, you can use the environment variables PGSSLMODE and PGSSLROOTCERT.
Then the PostgreSQL client library will verify that the server's certificate is actually signed by the CA certificate and that the server name is correct.
Of course that requires that your PostgreSQL client library was configured --with-openssl.