https is fine - just couple it with PKI enabled smart cards (these work generally by providing a client-side certificate for your TLS handshake). This is the st

https is fine - just couple it with PKI enabled smart cards (these work generally by providing a client-side certificate for your TLS handshake). This is the strategy the DoD is using for most/all web auth stuff now.