Not precisely an answer, but there's some related discussion here: https://cabforum.org/2025/06/11/minutes-of-the-f2f-65-meeting-in-toronto-canada-scwg-june-11

Not precisely an answer, but there's some related discussion here: https://cabforum.org/2025/06/11/minutes-of-the-f2f-65-meeting-in-toronto-canada-scwg-june-11-2025/#discussion-about-removal-of-clientauth-keypurposeid https://cabforum.org/2025/06/11/minutes-of-the-f2f-65-meetin... The real takeaway is that there's never been a lot of real thought put into supporting client authentication - e.g. there's no root CA program for client certificates. To use a term from that discussion, it's usually just "piggybacked" on server authentication.