You can export and import certs between devices, the UI is just awful. Possibly more awful than all the PGP UIs, if such a thing is possible.

Certainly you can't drive this flow from the website alone. The best you can do is point your users at various browser-specific instructions.

At which point you're back to the same basic problem with passwords: the weakest link and root-problem is the average user's lack of knowledge. There wouldn't be such a mad scramble to find a decent alternative to passwords if everyone was using KeePass or the like, and no alternative is going to be near-future viable if it relies on something too complicated for the nearly-everyone who isn't using strong generated passwords.

2FA is working because all the user has to do is get a text. Anything beyond that level of difficulty is simply a non-starter at this point.