If used as a "client certificate", it can make MITM attacks much more difficult
The Keygen tag is implemented across most non-IE browsers, making it very easy to implement
Works regardless of administrator permission. With IE Active X controls can be disabled and IE and browser settings can make key generation impossible on tightly controlled systems. In this situation the current Keygen in non-IE browsers is often the only error free method to generate and use Client certificates
Cons & Deficiencies
Certificates are not easily portable between systems (to some, this is a "pro")
The private key is not stored in a standard location
Requires the user to select the appropriate key length from a list. Most users are not equipped to make this decision.
Poor user experience when the user is prompted to download the certificate. A better approach would have the key submission and certificate response integrated into the same control. (possible solution also this on S.O. )
<keygen> does not provide a mechanism for managing certificate expiry
No standard key length or hash implemented across browsers
Algorithm support is missing (RSA, DSA, ECC, etc)
Keysize selection should come from the form, not user selectable.
The format used by is not standard and only provides a subset of already established protocols like PKCS10 , CMC , and CRMF . This prevents from supporting non-RSA based certificates, extensions for additional client information, and key escrow