It could be useful to add PKI/x509/client SSL authentication to the REST API to ease machine-to-machine interactions. A vendor could set up all their Koha instances to trust certificates signed by the a vendor's certificate authority public key. Then all new API consumers could just get certificates issued by the vendor's CA. That said, I suppose authorization would still be a problem. With Bug 6296, they were still mapping the certificate to a Koha user. And then there's the issue of how to handle revoked certificates. Maybe it is best just to rely on OAuth2 and Basic Auth.
"OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens" at https://tools.ietf.org/html/rfc8705 could be interesting... although it still has the per-implementation issue of certificate revocation management...
I was looking at FreeIPA (https://en.wikipedia.org/wiki/FreeIPA) and it got me on to DogTag (https://www.dogtagpki.org/wiki/PKI_Main_Page), which is an open source certificate authority that also supports OCSP for checking Certificate Revocation Lists.