Subject: [pkix] More on the deprecation of X.509 client certificates on the Web

From: Anders Rundgren <[email-masked]>
Date: Wed, 16 Sep 2015 09:18:20 +0200

Bard Hill (Facebook security expert):
https://lists.w3.org/Archives/Public/public-webappsec/2015Sep/0093.html

"and it puts authentication at a layer (the TLS handshake) where it is fundamentally problematic to the commonplace scalability and performance architecture of anything but hobbyist-level applications"

I agree with this [somewhat exaggerated] statement but taken literally it means that PIV won't (or shouldn't) be used on the Web since HTTPS CCA (Client Certificate Authentication) is the [currently] only solution available.