A compromised CA in a client cert PKI world, like the DOD one I was talking about, is effectively an end-game scenario. Every machine in the org. would have to be updated (root CA's don't have CRLs, afaik). The big risk isn't a mitm attack - that's a risk with traditional server-side certs. The big risk is that all of a sudden there are unlimited legitimate users with no control over identities anymore. It's like getting write access to /etc/passwd.

Doesn't that depend on how you authorize the client certs themselves?

It's one thing to _issue_ a cert. It's another to _approve_ that issued cert.

If you're blindly accepting certs, you've got other issues.