Seriously, why the hell are we still using username/password when browsers have supported requesting client certificates for years now.

Literally just learned today that it's an API that's supported in all the major browsers already. Maybe because it's at the TLS/Server-side layer instead of inside client-side JS or the HTTP layer?

Only downside is now I need to add this functionality to Agregore. :P