Looks like they're implementing this, which is also used by Cloudflare Turnstile: https://privacypass.github.io/

The standard has also been published as RFC9578: https://www.rfc-editor.org/rfc/rfc9578.html