"Keyless" means no long-term key to store, rotate or leak: the key exists only for one signing operation, and Fulcio's 10-minute certificate binds it to an identity such as repo:org/name from GitHub Actions or an e-mail address. Rekor's inclusion proof (or an RFC 3161 timestamp) shows the signature was made while the certificate was valid, so verification works years later.
Trust shifts to the identity provider, Fulcio and the log, and to the verifier's policy: which identities and issuers are acceptable. A compromised CI workflow or OIDC account can still sign; the transparency log makes such signing visible to monitors, which owners should actually run.