The new draft/account-registration allows clients to programmatically register a new account and save the password.

It would be nice to allow clients to programmatically add and remove authorized certificates for SASL EXTERNAL. This would allow clients to not save the password locally.