I think the most obscure thing I used was <keygen>, which would generate a client key/cert pair, store the key locally in your browser certificate store and send the cert to the server with the form submission

I saw exactly one website use it and remember being very confused as to how it achieved that

https://web.archive.org/web/20160409081411/https://lists.wha...