On: Why is nobody using SSL client certificates?

[mtrimpe]

I don't know what browsers do, but it's fairly easy to password protect these keys.

If you then keep the key accessible until some timeout (whether maximum or idle time) occurs then you've got pretty good security.

That's what you already get if you use LastPass e.a.