Spot on, this is the problem when you&#x27;re dealing with the general public.<p>You cannot expect them to have a certificate on them at all times except their ID card, and even that gets lost. And if they were to use their national ID card, as some do, they would need a smartcard reader. So with most computers looking like they do, that&#x27;s yet another thing they need available.<p>Banking here in Sweden uses a setup similar to either PKI or 2FA, but the thing you have is usually a code generating device or your mobile phone. This is imo as good as it gets, since most people today have mobile phones. The code generating device becomes something you only use from your home when paying bills so that&#x27;s out of the question for normal website authentication.<p>Another thing that was weird about the article is that it states client TLS certs as a 2FA method right after it says there would be no need for passwords. I fail to see the second factor in client certs if it&#x27;s not a password.