The CAs don't need to play any part in client-cert based authentication. You just generate a cert locally and then copy the public key to the site when you register. Subsequent logins are performed by the server checking if you own the right private key that matches the public key used on registration.
It's like SSH, not HTTPS.
CAs are only useful to match a cert to a domain and/or known organization, or inside an organization to make sure the user has a cert signed by the org itself.
"You just generate a cert locally and then copy the public key to the site when you register."
But how do you know you're copying your key to the right site and not some fake? Answer is, of course, you don't, so you need something else. And it's not stronger than the weakest link..
It's like SSH, not HTTPS.
CAs are only useful to match a cert to a domain and/or known organization, or inside an organization to make sure the user has a cert signed by the org itself.