What is, though?
It's basically just people with Estonian e-identity cards and a handful of people with organisational PKI.
I believe this could be solved by improving the interface used to accomplish these tasks (rather than using openssl req directly). Web browsers ask to save passwords and other sensitive information. There's no reason why they cannot relatively securely store a private key and the associated certificates.
> Key management is hard
That is true, but requiring key/certificate based auth in addition to the username and password for authentication means that attacks would have to be distributed amongst the users of a given website and the website itself rather than just attacking the website or some 3rd party used for 2FA (email or cell phone).
And breaches where backend databases are compromised and user credentials are retrieved also happen. But due to people re-using credentials on multiple services, they also get compromised on unrelated services. Using a private key and a certificate per service, it would be much harder to do something like that.
The big ones have supported this for two decades: https://www.digicert.com/managing-client-certificates.htm
Hardly anywhere uses it.
Sounds like another opportunities for the advertising companies like Google and Facebook to uniquely identify us.
perhaps blockchain can solve this problem too?