My suggestion for fixing the client cert problem is to task the browser with certificate generation upon profile creation. There are significant security implic

My suggestion for fixing the client cert problem is to task the browser with certificate generation upon profile creation. There are significant security implications of course, but sites aren't really incentivized to support client certificates. If 50% of my traffic already tried offering me a client cert the decision to allow them would be an easy one to make.