Because it's not user friendly? Especially across devices
Yes I could figure it out. But what about my grandmother? She can handle passwords, but definitely not certs.
Not that this couldn't be fixed (as the client side), but no one is doing this.
A simplest form (equivalent of basic auth, but secure) is mere "ssl_client_certificates file.pem; ssl_verify_client on;" or equivalent - one just have to tell "ask for certificate" and "here are my trusted issuers".
I guess, the only thing that's probably lacking is pluggable modules for popular web frameworks (issuing certs and matching them to users in DB).
even a hardware token like a yubikey or CAC has a bunch of problems and they are by far the "best" way to do something like this.