Well, every mutual TLS handshake authenticates again. And then establishes a session key. But if you fire up a new session (new tab?), boom, new mutual authenti

Well, every mutual TLS handshake authenticates again. And then establishes a session key. But if you fire up a new session (new tab?), boom, new mutual authentication. It's just that the private key is stored in a keystore, and not on a device, and you don't need to keep your finger on the fingerprint reader all the time. You could have every message signed with the sending party's private key, at some performance cost. And that signing could happen in a hardware device. Essentially what happens with hardware wallets for bitcoin.