How so? The private key never leaves the device, the certificates are site-based, preventing phishing, and they require actual physical interaction to authenticate.

This is miles better than password-based login.