https://twitter.com/SciresM/status/1024327784892530689
Looks like 11.8.0 backports the Switch's aauth ideas to 3ds -- network comms now send an encrypted(?) copy of app ticket to the server.