Ah, yes, a valid user certificate and the corresponding private key would allow you to impersonate the user for other RPs for the duration of the cert. That is

Ah, yes, a valid user certificate and the corresponding private key would allow you to impersonate the user for other RPs for the duration of the cert. That is troublesome. Edited more: If you ship the user a malicious client and the user runs it, you can just keep his email password. This probably grants you access to all of his accounts for longer than the cert would last anyway. If the user uses 2-factor auth, the private key + cert combo is more useful than the password though.