Signing keys

Each device has its own signing key. When you approve an agent policy, your device signs it so only you can authorize changes.