I created a proof of concept in here for integrating mTLS sessions with XMB.

https://github.com/miqrogroove/xmb/tree/session-ideas

The Certificates.php implementation is unlikely to be useful, but it's a good exercise in making the session system flexible and easier to plug.

Some of the related changes are useful. I'll start thinking about whether this is safe to merge back into the master branch.

How exactly does it work?

Looking into it, it's a means of the server and client verifying each other. Sounds useful and interesting (and fixes a flaw of TLS of blindly trusting the certificate chain), though more for the server backend than the client frontend as far as I can see.

This relies on Apache to handle the connection, custom PKI to create the certificates, and XMB simply reads the username from Apache.

The proof is for getting XMB to ignore all the cookies, supporting more than one auth system at the same time, and making it easier to configure without editing the Session system. The last limitation is that we still don't have any plugin system, so it requires a small hack in header.php to turn it on.