X.509 certs are a nice workflow indeed. We recently started using it at $dayjob (combined with yubikeys) to authenticate users.