>they are phishing resistant

But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know.

Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.