Requiring a fingerprint, face or PIN

With this on, the device must confirm who is holding it before it will sign, so a phone someone picked up unlocked is not enough on its own. With it off, presence alone is accepted: a tap on the security key or an already-unlocked screen. Leave it on. Off is weaker than the password it replaces, and every device sold in the last several years can satisfy it.