Part of the problem with this approach is that it uses one single system to represent a number of claims about the client that should actually be treated separately.  Identifying a user (who has history on a site) is different from identifying a hardware device, or a particular browser instance.  Without knowing which particular claim the certificate is presenting it is hard to know how much to trust it.  Just building a GUI does not solve this problem, and usage could create a false sense of security.  If a machine is compromised is a client cert really any better than a cookie?