They're used extensively in a lot of industry- just because it isn't used for logging onto Gmail doesn't mean it isn't used elsewhere. I work in utilities and client certificates are used for all or nearly all web clients and APIs.