Client certificates authenticate control of a private key
Mutual TLS authenticates a client’s control of a certificate’s private key as well as the server’s identity. It does not inherently identify a physical device. A copied software key can be used elsewhere; hardware binding and device attestation require additional mechanisms. An enrollment policy can associate a key with a device, but TLS alone does not establish that association. ...