Ideally, we shouldn't solely have to rely on unique username/password combinations to log into various accounts. As I mentioned in another comment, had websites and browser makers made it easier to use client-side TLS certificates as part of the authentication process, then both the certificate and a username/password would be needed to log into an account. Then even if someone decided to use the exact username/password combination across all their accounts, since they have a different client-side TLS cert for each account, it would not be practical to get into their accounts without access to the device that stored the private key and the associated certificates.