What is the difference between a bearer (Überbringer) and a holder of key (HoK)?

A bearer is a subject that hands an authentication assertion issued by the IdP to the RP without any further proof; a holder of key hands it over and additionally proves cryptographically that it possesses the associated private key.

* A bearer assertion works for whoever presents it; a holder-of-key assertion also demands proof of the private key. *

Bearer tokens are simpler but can be replayed by anyone who steals them; holder-of-key binding stops a stolen assertion from being used by someone else.

Go deeper:

• RFC 6750 Bearer Token Usage — how bearer tokens are presented, and the security considerations for anyone who holds one.
• RFC 9449 DPoP — proof of possession for OAuth tokens: the holder-of-key idea applied to access tokens.