I wish it was easier to just do authentication based on self-signed client certificates instead of passwords. Instead of cookies saving your login, do key-excha

I wish it was easier to just do authentication based on self-signed client certificates instead of passwords. Instead of cookies saving your login, do key-exchange of temporary client certificate. If it was done properly, it has the bonus security that it's completely immune to XSS stealing your authentication on the website - even if the website was subject to some XSS, they can't steal your authentication cookies, and the client certificate is inaccessible to JavaScript.