Actually, that's beside the point. My issue is that all this browser crypto activity is worthless if it doesn't authenticate the server that the user expects. This model is easy to attack because the user is a passive participant, who may not be at all aware of what's really going on underneath. This is a fundamental flaw in a system where server-authentication is a passive act. It is a crucial flaw when server-authentication is needed to protect subsequent user authentication.
Mutual authentication is stronger.
But it is trickier, and not provided by SSL today, when a user doesn't have a full-strength private key. In contrast, consider systems where a password provides mutual authentication. That's something the group may want to discuss. I'm assuming the user is enrolled somewhere and has a secret private key, stored somewhere other than on the client. The trick is to get it to the user, without requiring other machine-stored credentials to be already in the user's possession.