The problem with client-side certs is that things go through a queue, yeah. CSC are only secure to the server, not to the other device. You're right about the replay attacks, that's why I include a timestamp. Since commands usually take less than a second, it works well enough, but sequence numbers work too, yep.