Keeping identity separate from TLS makes a lot of sense to me!