Adding to your third point I am pretty sure there is still awful mobile browser support for client certs which is a dealbreaker just about every site out there these days