Public key authentication of <i>clients</i> (as opposed to <i>servers</i>), has been part of SSL since v1.0. This is just adding a misdirection, the underlying protocol is the same X.509 we&#x27;ve had since the late 1980s.<p>The main problems are:<p>1. Certificate authenticity -- the key has to be added to authorized_keys on the server. This includes certificate revocation and expiration, and re-establishing trust after certificate is lost.<p>2. Private key management -- how do I migrate keys to a new browser or a new machine? Where are the keys stored anyways? Absolute PITA in every existing implementation.<p>3. Key generation -- we need some more user-friendly tools if this is to catch up