BIP32 key that allows derivation of child public keys without private keys; useful for watch-only wallets and address discovery, must be kept confidential to avoid privacy leaks.