Password authentication over Gemini

[solderpunk]

>   There's no reason for the user to generate a certificate and then provide
> a username/password when the certificate already has the username:

This is kind of neat, but would require the interface interaction that
happens in response to a 61 to give the user the opportunity to specify
these details.  At best, this is an unnecessary bit of UI friction in
cases where it won't be used.  At worst, for very privacy-conscious
users, being asked to specify any kind of personal information at all to
include in something which is supposed to be an entirely ephemeral /
disposable / transient will feel like a red flag, I suspect.

>   This is one reason why my initial status code proposal supported
> certificates and "another way" left vague at the time.

I think I am pretty set on the philosophy of not building into the
protocol any kind of high-level actions which can be straightforwardly
achieved with combinations of lower-level actions already in there.
It's a great way to keep the protocol slim and easy to reason about.
 
>   Not much there, other than to ask about having second thoughs about
> certificate only authentication?

Sorry, can you clarify?  Do you mean second thoughts about only having
certificates as a way to authenticate (i.e. are we sure we don't want
passwords as first-class citizens?).  Or do you mean second thoughts
about allowing authentication with only a certificate?  Why wouldn't we
want to allow that?

-Solderpunk