Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever,

Technically, we can just use client certs, YK supports them (via smartcard emulation, you can also use that to auth via SSH), just it wasn't really there, ever, on UI front...