I agree that "client certs" is about the best you can really reliably do, and that is indeed what Duo et al are using