Could mutual TLS (mTLS) client certificate‑bound access tokens (defined in RFC 8705) integration be added into NGINX's OIDC Reference implementation. An example of its implementation was provided in a recent NGINX Plus R25 Blog Post. The OIDC Reference implementation would just need to validate that the cnf claim and client cert exists before performing the validation or provide an option to enable the feature. Please let me know if anymore detail would be helpful.