I've been working on PKAuth, which addresses this problem (not at the TLS level though). I wrote a short blog post [1] with a demo video about the underlying protocol. I'd appreciate any feedback!

[1] https://pkauth.com/blog/post/2018/08/27/announcing-pkap