PKCS11 support for user authentication

Context Certificates represent a user's identity in Mumble, and the consequences of a key compromise in this case are severe. If using Mumble on a machine you do not fully trust, it would be nice to have the ability to use e.g. a Yubikey to authenticate to Mumble servers without exposing the private key to the machine you're using. (This would also make it fairly easy to carry a Mumble identity with you between machines if you already regularly use a Yubikey, as I do.)

Describe the feature you have in mind If a PKCS11 smartcard with an installed certificate is inserted, Mumble would allow users to use that for authentication rather than a cert/key on disk.

Describe alternatives you've considered FIDO2 is a possible alternative, and FIDO2 keys are typically cheaper than PKCS11 smartcards. However, Mumble's auth system is already heavily reliant on X509 client certs; PKCS11 seems like it fits in better with the way Mumble works right now.