Which is exactly the same problem you would have with client certs. If an attacker can get a cookie why can't they also get a private key? Also a centralised

Which is exactly the same problem you would have with client certs. If an attacker can get a cookie why can't they also get a private key? Also a centralised system needs to have a way to recover accounts when credentials are lost. Without some kind of third party validation (which would reduce sign up) sites would have to rely on exactly the same methods to validate users as password + cookie. For consumer sites with badly maintained machines client certs just increase the attack surface with little real benefit.