Draft a spec to do Peer ID Authentication with Keying Material Exports for TLS

[MarcoPolo]

Meta and caveats:

• Creating this issue to track my current thoughts here.
• We may not even need/want this as we may prefer doing something with The Concealed HTTP Authentication Scheme.

This could serve as an alternative to our current TLS PeerID authentication scheme which uses certificate extensions to authenticate.

Pros:

• This would allow us to easily use a standard CA issued certificate and still have PeerID authentication.
• Use the same TLS cert for HTTP transport and stream transport.

Cons:

• One more way of doing peerid authentication.
• Will be subsumed once The Concealed HTTP Authentication Scheme is published (and available in browsers).
• Still doesn't work in browsers. See HTTP PeerID Auth for something that does.

---

I'd recommend holding off on this for now and investing the energy from here into a spec that makes use of The Concealed HTTP Authentication Scheme.