JWT should not be used for client auth

Here is a link to an issue with more links to articles
explaining what's wrong with usin JWT on the client:
shieldfy/API-Security-Checklist#6

README.md

@@ -19,7 +19,7 @@ questions about anything, feel free to open issues or PR's.
 - [x] logging (go-kit)
 - [x] instrumenting (prometheus)
 - [ ] opentracing (with appdash)
-- [ ] JWT for authentication
+- [ ] client authentication
 - [ ] authorisation somehow, somewhere
 - [ ] Proxying?
 - [ ] Load balancing?