I would&#x27;ve loved if I could just use a self-generated certificate to authenticate. Especially if they&#x27;d be on HSM like YubiKey&#x2F;NitroKey. Heck, there&#x27;s even &lt;keygen&gt; element in HTML5, so this could&#x27;ve been quite user-friendly hassle-free. I could consider paying someone to assert my identity, or get some assertions for free, or whatever - the possibilities could be limitless. However, there are few issues with this.<p>1. We&#x27;re currently stuck with X.509 and those don&#x27;t allow subkeys or multiple signatures.<p>2. Then, the problem is that, AFAIK, there&#x27;s no way to tell in that we accept just anything in TLS. I think there were a lot of discussions about allowing spontaneous authentication (changing state machine to allow TLS client to send certificate without CertificateRequest) or adding hacks like DN=WebID, but none is here. My memory&#x27;s blurry in this regard - I&#x27;ve read about this about an year or two ago, sorry. But I&#x27;m certain there were some issues here.<p>3. Then, the problem is, browser UI and UX for managing certificates are terrible. There weren&#x27;t any changes in this area for decades, and everything about those is deep hidden. Then, there are no subkeys and no cross-browser sync or key escrow mechanisms (opt-in, absolutely), so it&#x27;s very unlikely to be useable by average person. And so on.<p>So, format is not ready, protocol is not ready and browsers are not ready. Thus, sad but no, it&#x27;s not going to work.