Client authentication is going to be processed on the socket process/socket thread. But private keys are physically present only on the parent process. The UI/logic to select a client cert will still run on the parent process (or at least definitely the UI). The result would be a synthetic handle to send to socket process as a result of the selection that will then be passed to the new sync PKCS11 token, introduced in bug 1512475, and called back with to the parent process.

Pushed by kjang@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/fdbc063a4744 Use sync IPC to get client auth data from parent process r=keeler,mccr8