I like the reminder that this is out there and mostly available. I think many of the comments here are missing the point - they're saying it's useful for small

I like the reminder that this is out there and mostly available. I think many of the comments here are missing the point - they're saying it's useful for small-time projects with one or a few users and not needing to be integrated into a sophisticated infrastructure. No need to worry too much about hashing, logouts, the full chain of account management, etc. Use a full-featured solution if you need that, keep Basic Auth for a thing with a few admin pages where anything unusual gets handled over SSH. This also reminds me - Gemini uses client certs for a similar purpose. Gemini doesn't seem to have much going on, but it does make a good case for using client certs better. Right now, they're technically supported, but the UI for both browsers and server support is really clunky. Build a decent UI on both sides, and it could be a nice simple solution for higher-security authentication.