This page is hosted apart from your vault server, from the esec-vault repository (signer/). Passkeys work only here: your vault server cannot make one or have one sign anything. It shows exactly what each signature signs, decoded here from the signed bytes.
Sign this change
Changes waiting for you
Add a passkey
A passkey (YubiKey, Touch ID, your phone) signs changes for you here, one touch each: adding members, changing what members and machine groups read, and removals. Never admins, never keys.
Your new passkey's fingerprint:
Now, on one of your devices, run esec vault changes. Add the passkey only if the device shows exactly these words.