Glossary
Proof of Possession
Proof of possession lets a principal demonstrate that it holds a private key or secret without ever sending that secret over the network — usually by signing a challenge or a specific request, which the verifier checks against the corresponding public key. This is a stronger property than simply presenting a token, because a token by itself can be copied and replayed by whoever intercepts it.
A credential with proof of possession bound to it is far less useful if stolen in transit: an attacker who intercepts the signed artifact still cannot produce a new valid signature for a different request, because they never had the private key that would let them.