What is the controller key?

[AngusP]

The EXAMPLE 4 in §4.3.2 Read (Resolve) has

"controller": "did:key:z6DtNrvHVvvKHB7m8LrCmt131TGH7DbzvcPo9mZRoCt5rqms",

Which is a Secp256k1 key (from the z6Dt prefix -> 0xE7 -> Secp256k1 compressed pubkey per the multibase/multikey spec), but is that (always per this did spec?) the pubkey for the UTXO that was spent to create the DID, or the pubkey of the P2TR output that can be used to update the DID; or just another key that happens to be secp and could've been Ed25519/RSA/etc. instead (and if so where does it come from)?