I didn't understand it either, but on the "Security Now" podcast Steve said it's basically like using a FIDO2 key but virtualized in software. As I've used a yubikey and understand public/private keys (with ssh) I now have a vague idea.

As the sibiling comment alludes, FLOSS projects have been threatened for allowing (part of?) the key to be exported!