Client auth is explained in more details in the spec: https://github.com/aerofs/ssmp

Our most common use case is client certificates but there are provisions for alternate auth schemes.