This page is served by an attested image. The TLS key securing this connection was generated in the server's memory when the machine booted, and its hash is bound into the machine's TPM attestation.
The attestation token is at /.well-known/workload-attestation.