I guess that’s one context where it makes sense. The reason I have difficulty with public CA provided certificates for client certs is that client certs aren’t

I guess that’s one context where it makes sense. The reason I have difficulty with public CA provided certificates for client certs is that client certs aren’t primarily being used as authentication of a specific user (and maybe authorization). While in servers, certs are practically only being used for authenticating a connection to an endpoint. The issue here being that delegating client cert auth to a third party (Public CAs) means that you’re pushing the problem of monitoring the CA ecosystem to that client. A client that is limited and restricted by the rules of public CAs. But I guess this isn’t that different from OAUTH with a third party IdP.