You log in once to a PKI server and get authenticated for all PKI-enabled applications. It is not going to work for all applications, since an application needs to be certificate-enabled. Authentication is supposed to prove that the user is present at the controlling computer at the time of the test. Under SSO, when the user has to leave the room for any reason, any passing person can walk up to that user's computer and sign on somewhere via the SSO mechanism. But let's not be cynical.
Security is very difficult, both to understand and to implement.
Busy system administrators and IT managers don't have the time to really get under the casing of security technologies. So that's what vendors offer. Reality still falls far short of this promise, but then business is business and PKI vendors have something to sell.