I am guessing you are suggesting this as an absurdist argument (even if it is feasible !?!!) but I don't get why using client certs is bad? The downsides to se

I am guessing you are suggesting this as an absurdist argument (even if it is feasible !?!!) but I don't get why using client certs is bad? The downsides to session keys in cookies is immense and I don't see JWTs as being materially different. It appears to me there are two options : use out of band method to verify a HSM "belongs" to a given person (which has loads of issues) then 1. Use that HSM to establish a bearer token for future requests 2. use that HSM to establish a client certificate which at least avoids the problems of bearer token. I may of course be very wrong. PS To me the problems of "replacing passwords with something stronger" boil down to the fact that the vast majority of web sites out there are not protecting anything valuable. I have 300+ entries in my password vault and if I had to walk down the street to a "PKI office" and get my passport stamped to access each one, I would choose maybe five. I suspect that the vast amount of crap sites out there trying to find ways to make authentication stronger without actually making it less convenient for people i case they stop bothering to sign in, is just undermining the infrastructure we would need to have trustable authentication. If it's valuable to you, you will make the effort.