I used an SSL CA (Startcom / StartSSL) that used Client certs as its (only?) method of authentication. It was a terrible experience if you ever had to log in from another browser.