Seems that composer/composer#12406 is introducing a new addAuthenticationOptions method (to replace addAuthenticationHeader) which adds support for authenticating using a client cert. This is currently scheduled for Composer 2.9 (tbc)

Check into our codebase and update to use the new method when upgrading to Composer 2.9