Could in theory be utilized to move laterally in networks where client TLS is used for authentication, which I see used sometimes.