Why is a CSR signed and which key is used for signing? I know that a CSR includes a public key from which a signed certificate shall be generated.

But why is the CSR istself signed and which key is typically used?
For signing I need a private key, so the user of the CSR's signature must have the associated public key. But what key/pair is taken?
[Why] is the CSR istself signed?


The CSR is signed to ensure consistency of the data in it in a similar way to how root certificates are also self-signed. Additionally signing the CSR proves ownership of the private key corresponding to the public key in the CSR.


  [Which] key is typically used?


The private key which is associated with the public key embedded in your CSR.