Debian single sign-on (SSO) recently switched to using client certificates.

See https://wiki.debian.org/DebianSingleSignOn