> but why don't web browsers make signed requests, just as web servers make signed responses? They can. The WebID people at the W3C are trying to make a standa

> but why don't web browsers make signed requests, just as web servers make signed responses? They can. The WebID people at the W3C are trying to make a standard out of this, that would allow for federated authentication in which you can securely share data with websites you visit. (They're not getting terribly far - huge portions of the stack are missing around the subject of "tell a server you own that another server can access <these bits of data>, where the other server is identified using a WebID".) The downsides? Basically, the UI sucks and is inconsistent between browsers, up to and including failing to let you log out or have multiple accounts on a website.