Client certificates are harder to put in place than a login form. It requires to create the certificates and install them on every device which will log to the

Client certificates are harder to put in place than a login form. It requires to create the certificates and install them on every device which will log to the website. And you will have to manage the changes/lost of devices. But I agree it is a good solution in a 2FA for internal applications.