Token & session security

Token binding, primary refresh tokens, session keys, and defending against replay.

The real cryptography behind Entra token protection — key generation, TPM sealing, the signing model, and the half-truths that make it confusing.