If a CA is not at least allowing client certs (so that you can e.g. use a smartcard with a key for auth rather than a password) then yes they're doing it half-assed.

(Browser makers are quarter-assing their UX for using client certs, but that's a separate issue).