Ok fine let's talk about why mTLS is hard:
1) Browsers have terrible UI around client certificate choice and picking the wrong one or hitting the wrong button breaks everyting
2) Issuing client certs is painful (not very important as far as token binding is concerned, you can just self-sign)
3) Hardware-backed client certs are slow (I think this is less true today)
4) If you have front-end proxies that terminate TLS you need to handle it there

What else?

0

If you have a fediverse account, you can quote this note from your own instance. Search https://nondeterministic.computer/users/mjg59/statuses/116068314699788840 on your instance and quote it. (Note that quoting is not supported in Mastodon.)