Having spend the last week or so working with client certificates, they could be so much more if browsers implemented a proper interface for managing them, or at least a much more intuitive one than they do at the moment. They work spectacularly for building closed APIs where you control both sides, however. They're just a bit tricky for the end user most of the time