[vl]

But isn’t this exactly what client-side certificates are invented for?

[noduerme]

Yeah. Maybe out of paranoia, there was concern that a rogue employee could snatch a client side key and reestablish a session from outside. The fingerprinting was aimed at making any attempt at that easily identifiable.