Signed authentication material is data produced by an authenticator after it uses a private key to sign a login challenge. In passkey and WebAuthn flows, this usually includes a cryptographic assertion that proves the device holds the private key without revealing it. The server verifies the signature with the matching public key, which is why the login can be secure without a reusable password.
This matters because attackers often target the signed output or the system that stores and forwards it, rather than trying to break the cryptography itself. If malware, a browser flaw, or a platform component exposes valid signed material, an attacker may try to replay, relay, or abuse it within the allowed protocol context. Defenders should treat the endpoint, browser, and sync layer as part of the authentication perimeter, and prefer device-bound credentials where possible.