> The actual last thing in the world corporate users want is an authentication system their IT department doesn't control absolutely. You'd think that, but I c

> The actual last thing in the world corporate users want is an authentication system their IT department doesn't control absolutely. You'd think that, but I can't remember how many people have asked me how to implement mutual authentication using whatever random client certs their partners send to them and who don't realize that putting all those issuers in the SSL handshake bloats the heck out of it. So they may well end up both accepting every random client cert issued by Entrust, Verisign, etc. and then advertising that fact to the world with every SSL handshake.