7
Just one additional level of defence, not 100%
If:
- your server is Apache
- you have rights to modify httpd.conf (or ask do it for you)
- you can create and maintain own private Certificate Authority
(I doesn't say "all will be easy")
you can implement certificate-based client authentication, see details (for example)
here. Just to note - it doesn't prevent your users from exporting own certificate and transferring to another person, but... not every ordinary user will be able to do it
BTW - I had own CA and can issue certs for your users