No, more easy.

After PR 166 (cert auth support) I will check here if the received client certificate is one SIGNED by our CA so external CAs will be used for notifications and our CA for privilaged API.

We can sign a client certificate for all partners we want to allow them to wakeup handsets in our networks.

WDYT?