holderUserAuthentication

Require the holder's biometrics or screen lock for each signature by a holder key — that is, to present a credential. It needs a secure lock screen; without one, creating a holder key fails. It needs API 30: below it the key store refuses it at construction; set it false there, and authenticate the holder in the app before presenting.