It&#x27;s not really for security or trust, but rather a temporary credential to avoid having them create an account during that precious first impression. They&#x27;d probably have to add a traditional password and email later on, but they could get started using it without needing that burden right away. I&#x27;d even be okay expiring the certificates after a week, since you should have a permanent account by then.<p>One time, I automatically created &#x27;accounts&#x27; for people based on their IP address on a toy project, because I didn&#x27;t want to manage emails or passwords. It made it really convenient to use, but there&#x27;s no way it would work as a permanent solution. I was imagining client certificates for a slightly more durable replacement, but for the same purpose.<p>Then again, OAuth logins seem to give something about as good so maybe this isn&#x27;t necessary anymore. I never really bothers me to log in with Google.