Yeah, you're right. I should have included those, but I'm really talking about per-client certificate authentication vs a shared secret.