This is an OPS-DIR review of TLS 1.3 Extension for Certificate-based Authentication with an External Pre-Shared Key (draft-ietf-tls-tls13-cert-with-extern-psk) This ID proposes a TLS 3.1 extension to better prepare for the post quantum computer crypto-armageddon world. The document is very clearly written, as I expect from Russ. I expect there will be some operational issues around hand holding users to get the correct setup to make use of the extension but since this extension basically enables the simultaneous use of existing TLS options any such issues should be confined to sites using exclusively one or the other option and I do not see any way to mitigate such situations.