It would have been great if the KEYGEN element's semantics meant - generating a fresh keypair of a certain strength and persistence of the newly generated ke

It would have been great if the KEYGEN element's semantics meant - generating a fresh keypair of a certain strength and persistence of the newly generated key if a keypair is not associated with a specific domain - selection of the keypair from the persistence store using a browser's UI dialog if a keypair is already associated with the specific domain, with an option to regenerate the keypair That would have been a good declarative alternative for password-based-authentication. It would have enabled client-side id generation and simplified user registration and other authentication flows, including perhaps keyrotation. I guess we should use webauthn now.