The key the instance attestation attests, which signs the client attestation PoP (or the DPoP proof).