Client certificates have failed. We should thank MUA and browser vendors for that - they made everything to keep UIs as scary and unusable as possible. It cou

Client certificates have failed. We should thank MUA and browser vendors for that - they made everything to keep UIs as scary and unusable as possible. It could've been different if MUAs had allowed (or even suggested) users to generate keypairs and send CSRs in a simple streamlined way. Maybe even cooperate with StartSSL and alikes (like Thunderbird cooperates with file hosting services to send large attachments, huh) to automate the request sending and validation.