&gt;&gt;  Direct support for non-repudiable signatures on the transactions themselves. Unless I&#x27;m misunderstanding what the client certs are doing in this protocol, TAuth seems to give non-repudiation on the session setup but not on the transactions themselves.
&gt;
&gt; There is nothing stopping the API provider enforcing layer 7 signatures too, it&#x27;s an application concern. The same private key can be used to compute those signatures or as X.509 certs can embed arbitrary public keys, you can choose another one for transaction signatures.<p>So what, exactly, is non-repudiable?  If I go to a highly enlightened court wielding a signature, what can I prove to that court?  That my app really did connect to your server at the time I allege it did?  This seems weak to me.