Isn't the point of client certs that the private key should never leave the machine? I.e. when you want to get access from a Smartphone you just initiate a new certification process, some admin ticks off a new public key and you're set? For consumer faced apps I could see some initial authentication process where for every new public key the user gets an E-Mail in order to activate it. Using it this way I think there is also no reason to use the browser UI for importing / exporting certificates, at least not for the users themselves. Still, the question remains why no-one is using it.