The matching public key is computed from it and injected into the instance at creation, so there is nothing to keep in sync by hand: rotating this credential rotates the authorized key with it. Passphrase-protected keys work, provided the passphrase is stored on the credential itself.
The fingerprint shown beneath this field is the key Namespace will actually authorise. If it cannot be computed, the key is in a format this plugin cannot read, or its passphrase is missing from the credential.