There's a world of difference between a well-designed pubkey interface like ssh-agent and what you get in today's browsers. I don't know how feasible it would

There's a world of difference between a well-designed pubkey interface like ssh-agent and what you get in today's browsers. I don't know how feasible it would be to replace passwords for the general public, but if browser vendors were actually serious about security, they could go a very long way towards making client certs feasible just by giving up on their current strategy of putting their fingers in their ears and pretending it doesn't exist.