TLDR: they're used as a revocation mechanism for DKIM.

non "paywalled" link: https://threadreaderapp.com/thread/1852021884902138123.html