Each scheme is a two-byte code naming algorithm, curve and hash: ecdsa_secp256r1_sha256 (0x0403), ecdsa_secp384r1_sha384 (0x0503), rsa_pss_rsae_sha256 (0x0804), rsa_pss_pss_sha256 (0x0809), ed25519 (0x0807), ed448 (0x0808), rsa_pkcs1_sha256 (0x0401). In TLS 1.3 the rsa_pkcs1_* schemes may appear only for certificate signatures, never for CertificateVerify.
The server must find a certificate and scheme pair the client accepts; failures appear as no shared signature algorithms or handshake_failure. A server can hold both an ECDSA and an RSA certificate and choose by this list. Post-quantum signature schemes (ML-DSA, composite variants) will be negotiated here once their TLS codepoints are standardized.