I wrote a blog post about the pros and cons of Client-Initiated Backchannel Authentication. Have a look at it here: https://curity.io/blog/whats-the-deal-with-ciba/