> If your certificates aren't stored in the clear (either passphrase secured or on a physical token), then you can solve the public machine problem and logging

> If your certificates aren't stored in the clear (either passphrase secured or on a physical token), then you can solve the public machine problem and logging out. Sure, but then you have to distribute physical tokens to people, and most people will not buy their own tokens. And once you've built a protocol to get a passphrase-secured cert from an arbitrary provider, you have the same problems the likes of BrowserID had with convincing browsers to adopt it. You also have to deal with building a protocol for updating certs as they expire, and other hard problems with key management.