<keygen> deprecation needs carrot, stick, and/or scary warning

[SamB]

https://html.spec.whatwg.org/multipage/forms.html#the-keygen-element

This feature is in the process of being removed from the Web platform. (This is a long process that takes many years.) Using the keygen element at this time is highly discouraged.

Without any hint about what to do instead and/or explanation of how the feature is harmful, this notice doesn't seem likely to be very effective in warding off users.

I say this because it looks like Debian started using this in their single-sign-on system within the past couple of years (see https://anonscm.debian.org/cgit/debian-sso/debian-sso.git/tree/spkac/templates/spkac/enroll.html), and I can't even see any reason they shouldn't have. (Especially since they don't absolutely require it: the system also supports the more arcane approach using the command line, as described in the other branch of the {% if manual %} conditional in the same template.)

[domenic]

Well, it's already not implemented in Edge, and being removed from Chrome: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/z_qEpmzzKh8. So writing interoperable code might help.

Otherwise, I agree it might be a good idea to explain why keygen is bad for the web. The linked blink-dev thread and its corresponding intent to deprecate should help there.