If you&#x27;ve got a server you&#x27;re comfortable typing passwords at (which you probably are, if you&#x27;re using &lt;keygen&gt;), you ought to be able to set up some sort of server-based authentication like Shibboleth or OpenID Connnect (which is really more of an OAuth than an OpenID...).<p>If you want something that matches X.509 client certs closely, WebCrypto + localStorage + either an extension or a static site (to host the JS that can get access to your localStorage and sign a site-specific token) ought to work, though I&#x27;m not sure I know of any out-of-the-box implementations. Mozilla Persona is essentially this, although since it&#x27;s a somewhat different use case it&#x27;s probably not an out-of-the-box thing.<p>Google would probably encourage you to use FIDO UAF. <a href="https:&#x2F;&#x2F;fidoalliance.org&#x2F;specifications&#x2F;overview&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fidoalliance.org&#x2F;specifications&#x2F;overview&#x2F;</a>