> it's impossible to do things like logging out, or using a public machine reasonably

Both of those are really the same issue, and they boil down to 'only use a browser instance you own to use a secure site, and don't share ownership of browser instances.' That seems pretty reasonable to me: indeed, anyone who uses a shared browser for private communications has already lost, badly.

The upside of not logging out is never having to log in.

You're correct about the pain of managing certs across devices.