Why is client authentication not done through the KeyExchange like with the server, but through a CertificateVerify
message?
When using RSA key exchange the client encrypts the key material with the server's public key so only the real server (which has the private key) can decrypt it. [RFC5246: 7.4.7.1] Why doesn't the client also sign the key material with its private key when using client authentication?
When using Diffie-Hellman key exchange the server signs it's key parameters using its private key to prove it has the private key (and therefore is the real server). [RFC5246: 7.4.7.2] Why doesn't the client sign it's parameters too when using client authentication?
Instead of these (I think more logical) methods, the client sends a CertificateVerify message with a signature over all handshake messages. Why is this method chosen?
This only applies to certificates with signing ability, because with eg. static DH certificates client authentication is performed during the KeyExchange. [RFC5246: 7.4.8]