Forum OpenACS Development: nsopenssl, authentication, and digital signatures

I know that the current version of nsopenssl supports client certificates. Has anyone tried to use this for authenticating clients?

Can I use nsopenssl to apply a digital signature to form data? I looked at the tcl API but I don't have any experience with this module. I'm working on an intranet application so an IE only solution and requiring a commercial CA would be ok.

Unrelated question? Can I store a token on a floppy disk or USB keychain drive and access this from a web application. Specifically, can I require two factors to login or to submit data? Thanks for any thoughts.