Article author here. Many native apps of course will use HTTPS and will be able to use ordinary Persona. The protocol described in the article is for native app

Article author here. Many native apps of course will use HTTPS and will be able to use ordinary Persona. The protocol described in the article is for native applications that need replay detection, key exchange, mutual authentication, etc (particularly those that already use SASL and/or cannot use TLS).