Agreed. Even server-side, the software is awful - setting up a root-CA-signed certificate chain with the OpenSSL command-line tools (and java's keytool) is an absolute nightmare. Apart from anything else, it's astonishingly difficult to tell when you've got it right, and by extension, it's astonishingly difficult to tell when you've got it subtly (or not so subtly) wrong. This has nothing to do with the principles at play, and everything to do with how the information is presented.

No, the main point is to show how simple client verification actually is. This implementation is one step up on the application stack into a comfort zone which seems to be more acceptable by devs.

I believe in design in depth, and by allowing the most basic of techniques (form submission + cli tool stack) to handle something that is generally perceived as difficult and letting people "get" the manual process, the automation might not seem as daunting.

I did not intend to create a standard, just to provoke more discussion. I would however by gladly surprised if I woke up tomorrow and twitter allowed me to sign in by solving a challenge instead of a password : ).