Well, the primary thing being deprecated right now is &lt;keygen&gt;, not certificate auth as a whole, so if you have a CAC you don&#x27;t care about &lt;keygen&gt;.<p>But also -- why does it make sense that <i>any website on the public internet</i> can potentially find your US-government-signed identity? That&#x27;s not even a thing the government wants. You can just do logins against a single government-run service and limit authentication to that one origin, and have it produce signed, encrypted statements that you can pass to other authorized servers. And then you also get auditing, revocation, etc. through that single service.