short life certs from server cert endpoints

In rest it makes sense for a service to consume a webid, then mint a short
life cert that it expects  the next ssl handshake to quote back to it.

 

Assuming server cert has certsigning key usage , server-cum-ca could chain
said cert to its own server cert chain. The client sends it back to the
server in ssl handshake to assert session, or releases it to others as a
kind of idp token.