[muaddirac]

Since I didn't see this elsewhere - client certs have privacy concerns, because by the time you've done your handshake the other side knows exactly who you are. This pretty much rules out always-presented certs. Because of that, you would need to manage the certs more directly, and then you get into all of the UX issues around managing certs.