Certificates make no difference in the threat scenario we were discussing: if I have enough access to your computer to pilfer passwords, I can snag your certificates at the same time.