Add a brief explanation of resident keys

docs/pages/access-controls/guides/passwordless.mdx

@@ -109,8 +109,12 @@ $ tsh mfa add
 ```
 
 If you are using a hardware device, a passwordless registration will occupy a
-resident key slot. Regardless of your device type, passwordless registrations
-may also be used for regular MFA.
+resident key slot. Resident keys, also called discoverable credentials, are
+stored in persistent memory in the authenticator, unlike MFA keys which are
+encrypted by the authenticator and stored in the Teleport Auth Server.
+
+Regardless of your device type, passwordless registrations may also be used for
+regular MFA.
 
 <Admonition type="tip" title="Important">
 If you plan on relying exclusively on passwordless, it's recommended to register