Comically you can sign Tailnet lock from iOS, but it’s an insane workflow.

You need to generate a QR code then scan it from the signing mobile device, which opens a secret menu option to sign (fine just brings up a confirmation dialog).

Incredibly annoying but perhaps more secure vs the threat of randomly tapping at prompts