This is part of a new firmware update for mk4 and q. I'm sharing because I found it confusing, and took the time to understand it, and it's pretty neat.

ELI5: the hardware wallet can be configured to only allow spends according to a spending policy. To break the policy, you need to cosign with a second device.

How it works: the device holds two keys on-device which will both sign transactions according to a spending policy. You hold another third key off-device. If you want to break the spending policy, only one on-device key will sign, so you need to co-sign with the off-device key to spend in that case.

I'm not sure how this will be used exactly, like what use case the coldcard people had in mind, but I enjoy little things this.