Use real keys for the client so the server can request client authentication. Everything is still terrible.