[pfx] What does dkim=pass (2048-bit key; unprotected) mean?

I received an email sent via HubSpot. It has two DKIM signatures. Postfix shows this: Authentication-Results: DOMAIN1; dkim=pass (2048-bit key; secure) header.d=DOMAIN2 header.i=@DOMAIN2 header.a=rsa-sha256 header.s=hs1 header.b=IrJ0eBW4; dkim=pass (2048-bit key; unprotected) h

[pfx] Re: What does dkim=pass (2048-bit key; unprotected) mean?

dig +dnssec any hs1._domainkey.transactional.hubspotemail.net Produces: ;; ANSWER SECTION: hs1._domainkey.transactional.hubspotemail.net. 1800 IN TXT "k=rsa;t=s;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp0DwbY9ubc2mwnm+Tam8icCWOM8C8kka4TRUU