Firstly, PKI generally doesn't have a key distribution problem because keys never get distributed; they get generated in-place, certificate signing requests are

Firstly, PKI generally doesn't have a key distribution problem because keys never get distributed; they get generated in-place, certificate signing requests are sent to certificate authorities, certificates are signed and returned. Secondly, in the TOFU model that applies to WebAuthn, you don't even need to have a certificate authority - you can self-sign. The problem is really, as alluded to another comment, that if you share a single certificate across multiple sites then you are sharing a common tracking id between them (e.g. your certificate fingerprint). Logout is also a user experience pain point unless the certificates are stored on e.g. a smart card that can be removed.