Web Authentication: Proposed API for accessing Public Key Credentials
Client-side TLS certs have been a thing approximately forever, yet everyone is hesitant to use them because... installing a cert in your browser is hard, I guess?Many corporations and agencies use certificates either as the primary (only) auth method, or as supplementary auth. For example, DTrade, the US defense export licensing system: http://www.pmddtc.state.gov/DTRADE/index.htmlWe use them at work and they work great. Pretty much instant auth to any internal site with no shenanigans.