That's the genesis of Klink's realisation that if a user's browser behaves differently depending on server config, there might be some way to use that behaviour to infer which intermediate certificates are in their cache – and use that knowledge to create a user fingerprint.