It seems to me that the recommended way of adding clients to a chef server - or my understanding of it - is flawed.

from the docs:

When the chef-client runs, it checks if it has a client key. If the client key does not exist, it then attempts to "borrow" the validation client's identity to register itself with the server. In order to do that, the validation client's private key needs to be copied to the host and placed in /etc/chef/validation.pem.

So the "validation key" is basically the superuser credential, allowing anyone who possesses it full access to the chef server? Am I reading this right?

Surely the correct model would be for clients to generate their own keypair, and submit the public key to the chef server. Clients should never need access to this superuser "validation key".

How can I do it in this, more secure, manner?