Aye in the end I don&#x27;t think the protocol itself matters as much as the concept of doing (asymmetric) auth in the browser rather than layered over http. Yelling &quot;but it already exists! client certs!&quot; is kinda unproductive, like you said there&#x27;s a reason nobody uses them.