Creates a signing key that stays on this phone and cannot be copied off it. Send the public key to the admin to be added to the signer list.
Safe to send over anything — this is the public half. The signing key itself never leaves this phone. The admin pastes it into the root console, which re-signs the signer list.
Tick only if the venue machine will not be online. That key then never has to check in, so it cannot be revoked remotely either - it stops when it expires. Leave it clear whenever you can.