I'm aware that client certificates exist. I'm not aware of anyone actually using them.

It also doesn't really have the problem of "unapproved" sites. You are already installing a certificate on the client. It's no extra work to add another trusted CA at the same time.