It is generated by the PublicCertificateAuthorityService when the ExternalAccountKey is created. Note: This property is sensitive and will not be displayed in the plan.