I feel like there is an easy solution to login csrf with IdP initiated flows. The SP just gives a pop up saying - you are logging into X as user Y. Continue?
It's an easy solution, but it doesn't work at all.
For starters, users generally do not understand what a cert validation error means. They do understand what it means to browse to a website.
The cert validation error is in the way of the user's intended action. This popup would not be.
Fundamentally such a pop up is not a security warning. It does not indicate that something is unsafe. That makes a world of difference.
I think a better comparison would be when you exit an app, and the app prompts you if you want to save. That has generally worked well.