Client certificates have privacy concerns when used with ordinary web sites, as opposed to the API requests assumed in that blogpost. WebAuthn provides a tweaked featureset that addresses these concerns.

Within the DoD, it's ubiquitous. see https://en.wikipedia.org/wiki/Common_Access_Card

It's the classic key distribution problem. You'd have to get client certificates to people securely. It works for corporations because they can send you a device with the client cert pre-loaded.

Firstly, PKI generally doesn't have a key distribution problem because keys never get distributed; they get generated in-place, certificate signing requests are sent to certificate authorities, certificates are signed and returned.

Secondly, in the TOFU model that applies to WebAuthn, you don't even need to have a certificate authority - you can self-sign.

The problem is really, as alluded to another comment, that if you share a single certificate across multiple sites then you are sharing a common tracking id between them (e.g. your certificate fingerprint).

Logout is also a user experience pain point unless the certificates are stored on e.g. a smart card that can be removed.