I think a more sensible approach should be similar to `authorized_keys` with `ssh`, where the server keeps a list of public keys for each user, and challenges the user to prove he&#x2F;she has the corresponding private key for authentication. TLS certificates are notoriously complicated. It may be necessary for server certificates, because the &quot;trust the key on the first connection&quot; is probably insecure when money is at stake, but I don&#x27;t see any advantages of client certificates over the ssh scheme.<p>If only it were standardized and widely supported.