> Since most people use several devices (desktop/notebook/tablet/phone) throughout the day, you require some way to keep them in sync. The obvious solution, ra

> Since most people use several devices (desktop/notebook/tablet/phone) throughout the day, you require some way to keep them in sync. The obvious solution, rather than syncing the certificates, would be to allow more than one client certificate per account. Each device would have its own certificate. If one device is compromised you need only revoke that particular certificate; other devices could still access the account. To avoid the need to manually register multiple certificates for each account you could cross-sign the per-device certificates; i.e. if key A is registered, and key B is signed by key A, then key B can also be used to sign in, perhaps with a warning sent to the owner of the account about a login from a new device.