Originally posted here by SittingDuck
If you are running any kind of admin section, all the traffic to that area should be done over ssl, you never know who might be listening .
Indeed...

That is how ssl client side certificate authentication works .
Perhaps I wasn't clear. I meant an HTML form, with a PHP backend which does the key processing. The key could be arbitrarily generated.