"any time the user is using a new browser they have to go through extra authentication steps"

And one wonders why no one wants to do this stuff.

This is poor analysis. You're arguing from an incomplete position. The choice isn't between "some security" (mobile certs) and "best security" (forced reauthentication). It's between "bad security" (multiple accounts with shared passwords) and "better security" (single cloud account with escrowed access to the cert).