He also concurs on the usefulness of digital certificates. I'm amazed that so few companies use digital certificates. They solve a spectrum of EC security problems, and are well worth the investment of building the infrastructure. Specifically, digital certificates can solve or significantly mitigate the problems of user-selected passwords. Users consistently choose weak passwords.
Users consistently use the same password on site after site.
Customer support organizations must have a way to change user passwords. Digital certificates can help resolve many of these issues. Repudiation is another problem. It could be a huge problem. With certs you have a legal relationship with that user.