Not everything is a website and not all connections are from people. Sure, you can use a token to authenticate with but how do you get that token? Yeah, a perso

Not everything is a website and not all connections are from people. Sure, you can use a token to authenticate with but how do you get that token? Yeah, a person can use a password or a passkey through some OAuth flow and get a token as a stand-in for subsequent connections on their behalf. Public CA TLS PKI is nice because it gives a root-of-trust for machines to start with using a DNS challenge. Then using it directly with mTLS for authentication could get you that token for operations. I suppose the main thing that is going away with this change is a somewhat easy and secure way to distribute identity/secrets for machine-based authentication. People-based authentication mechanisms are well-built and fairly easy to use.