That is interesting, but surely the client-side cert could just be copied and used in a dummy app?