@nixCraft
In environments that support it I use Kerberos (usually AD) with GSSAPI. Is cert auth superior?