The cryptosystem required to do per-app certificates is already resident in every mainstream browser; we are literally a UI/UX fix away from having that working.
Meanwhile, to a first approximation, zero people have tokens.
Web servers would have to be retrofitted to sign, distribute, and authenticate client certificates, so there is O(apps) work to be done. For symmetric tokens, each app would just have to store the token in the user DB, and then tell the client to hold it in local storage, which is probably less work for the server admin, and also doesn't require browser support.
Meanwhile, to a first approximation, zero people have tokens.