I am torn between "Chromium plugin" and "client cert" too, given that we have the capability to provision either, and a plugin is probably overall a nicer user experience 😛