I was asking about standards for Web-based capabilities, delegated authentication, and public key tokens; not the individual message authentication or (a)symmet

I was asking about standards for Web-based capabilities, delegated authentication, and public key tokens; not the individual message authentication or (a)symmetric encryption components. Echoing tptacek's comment above: the problems with using those individual pieces is in the joinery - combining them in ways that are broken.