Which two of the integration patterns below support such authentication?

Universal Containers would like to ensure that the server and client-side app’s identity is mutually authenticated for all integrations.

Which two of the integration patterns below support such authentication?
A . Apex callout to the client-side app with the callout payload encrypted with custom Apex code.
B . Outbound message received by client-side app that uses a Salesforce-provided client certificate.
C . Apex callout with the client-side app that provides Salesforce with a CA-signed client certificate.
D . Outbound message sent to a client-side app endpoint defined with a Per-User Named Credential.

Answer: B,C