I agree, the technology is there to do this (use client certificates for site login) exists today - StartSSL is one place that does this. The problem is essent

I agree, the technology is there to do this (use client certificates for site login) exists today - StartSSL is one place that does this. The problem is essentially that moving your certificate store around is not a task that Joe User can accomplish, because the UI sucks. (Oh, and I also agree that this problem also exists for browser-based password stores). Build a better interface, and it might just work. For example, I should be able to roll up to a new browser, login to some "home site" (whether run by Apple, Google, Firefox or whoever) and use my single username/password to download a client certificate, that then authorises me to login to my accounts on Twitter, Facebook and so on. Ideally, I could request a time-limited temporary certificate, so that it becomes useless after I've gone.