I'm a bit confused regarding the order of things to make this happen.
This is what I had in mind:
1 - Generate CA public and private key.
2 - Use CA Public Key with SFTP server (TrustedUserCAKeys).
3 - Generate a user private + public key.
4 - Sign user private key using CA.
5 - Connect to the SFTP server using the private key, username and winscp.
Should this work?