I'm a big fan of them, sadly there are a few issues, other than certificate management - safari doesn't handle them well at all in my experience for example

Yeah, try setting up TLS client cert remotely for your grandma and few people... manual iptables is easyer, then :)

It's just one click and hopefully a password away. I use "personal CAs" everywhere, if you share the p12 file via a webserver it's installed by the browser when you click on the link, and share the password over phone or another medium.