Reply to thread

To me this sounds a bit like reinventing the wheel ...

Secure, public key cryptography based client authentication exists since ages - TLS Client Certificates.

This is supported in almost every browser and webserver, the only problem is that apparently nobody uses them (for this usecase, they are being used in machine-machine communication though).