The cryptographic challenge provided by the server that must be signed to prove possession of the private key. This challenge is included in the JWT claims and signed with the user's device key.