The key a credential is bound to; it signs only when presenting, and may require user authentication.
The purpose as the Go side names it.