It's sad that I didn't realize he easy this was to implement now. I'm building several sites that implement bitcoins and this has clear advantages over simple u

It's sad that I didn't realize he easy this was to implement now. I'm building several sites that implement bitcoins and this has clear advantages over simple usernames and passwords. My thought is allow the user to authenticate with the SSL cert. If they're at an IP never seen before, require a password. Thoughts? My concern is with people that have a compromised computer that has a Remote Access Toolkit installed on it. Perhaps always require the SSL cert AND a password pair? Not that passwords would be safe on an infected machine. These days it seems that the only way to be sure is to require additional authentication from a second device such as a phone with a 2FA app like Google authenticator or Authy or a hardware device like a Yubi key. Even sending one-time text message confirmation xodes .