DPoP[1] is on its way and already starting to see adoption by identity providers like Okta[2] (oh, the comedy). It's unfortunately specific to OAuth, so narrower in terms of application, but will cover how most web apps work today.
2. https://www.okta.com/blog/2023/06/a-leap-forward-in-token-se...