Comment:

The "cert" parameter requires more documentation to indicate that it is a keychain (containing a private key). Further, an identifier for the specific Private Key may be required.

Keychains such as this are not typically available at accessible URLs. Rather, they are embedded in devices (or operating system user profiles for us). I therefore disagree that this is a common enough item of functionality to include in the FHIR Core

I recommend stating that if a signature is required, the client should generate it and upload it to the server and perhaps put the Private Keychain/Passphrase option in a seprate extension/profile.