Client certificates are doomed, looking into the future (think: keygen tag). Especially if you are using hardware tokens, and if you want to use them in TLS cli

Client certificates are doomed, looking into the future (think: keygen tag). Especially if you are using hardware tokens, and if you want to use them in TLS client authentication. We have been doing this for years in .ee, and the user experience has been mediocre. And this is something we can not fix (browser vendors can). The future promises to be FIDO, but then again, this is a different model, that mostly addresses authentication ONLY. I just started a weekend project to bring the hardware token based authentication to a state that it could be called "standardized", for the huge EU market, where very many citizens in different countries have a vetted PKI identity on the eID smart card. Might be of interest. https://github.com/martinpaljak/x509-webauth/wiki/WebAuth https://github.com/martinpaljak/x509-webauth/wiki/WebAuth The core of it is just a profile of OpenID Connect ID Token, with fresh browser extensions with native messaging support to facilitate actual communication to hardware tokens.