1. client certificates only replace passwords, not arbitrary encrypted data.<p>2. client certificate distribution is still a mess. At a minimum, there should be a standard way for servers to generate certificates and install them in the browser (with user visibility but without requiring user interaction).