&gt; But why you would ever think that a standard would give more flexibility to certificates than it does cookies?<p>Cookies <i>management</i>, as seen from the user, is straightforward: there&#x27;s a way to delete them all for a given site, and recently, thanks to the EU there&#x27;s a banner telling him that there are cookies. The user can&#x27;t do much more than that. Moreover, cookies are a crutch for the <i>server</i> to handle state.<p>Certificate <i>management</i>, on the other hand, is going to be a whole another animal, not only because there are much more things to handle, but also because we start dealing with crypto; moreover, we&#x27;re talking about <i>client</i> certificates here, so IMO it should absolutely remain under the user control. I like to think that the website is a potential enemy (whether it wants to or not), and the browser is an ally so the less a website controls, the better.