[META] Re-authenticating a device

This is a meta issue to discuss how to re-authenticate a device that has been connected at least once, especially if the authentication would not be on top of Web PKI. For example, we could check the device's hash (#1), we could verify the cached parameters (ZKP, etc.) for J-PAKE (#2), etc.

Any additional suggestions, proposals, or comments are welcome!