Using client certificates that are not issued by you poses some threat.

Anyone who knows the email of one of your users and can finda CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.

Using client certificates that are not issued by you poses some threat.

Anyone who knows the email of one of your users and can find a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.

Using client certificate that are not issued by you poses some threat.

Anyone who know the email of one of your user and can found a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.

Using client certificates that are not issued by you poses some threat.

Anyone who knows the email of one of your users and can finda CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.