There's one thing about client certs that people should be aware: They open up new security and privacy issues. There have been a number of TLS protocol issues

There's one thing about client certs that people should be aware: They open up new security and privacy issues. There have been a number of TLS protocol issues regarding client certificates that didn't receive that much attention (Triple Handshake, SLOTH), because not that many people use clientcerts. That's not really an argument against them, but it's a hint that if we want to use them more widely things would probably need more scrunity in security analysis. Another issue that worries me more: Client certificates can break privacy expectations. The reason is that the cert is not hidden from the traffic. This makes the traffic less privacy preserving than - let's say - a simple password, because the password is hidden inside the TLS encryption stream, while the client certificate is not. I think users have a reasonable expectation that "if I only surf HTTPS sites nobody sees any personally identifiable information from me, just the sites I'm surfing". Client certificates break this expectation.