It's so awesome, and the documentation and tooling suck so hard. Such a frustrating ecosystem...
The only real low point in the documentation I've found was around MIT Kerberos.
I implemented a PKCS#11 module from the documentation for NIST SP 800-73 and RSA PKCS#11 in about a week.
What things do you think could be better documented ?
There are many advantages of something like PKCS#11 over One-Time-Passwords (TOTP/HOTP):
1. Since you have an X.509v3 certificate, you have an identity not just an authenticator -- so when you are using this certificate to login to systems, you don't also have to supply an identification (though most systems let you optionally supply one, e.g., if you can login with multiple usernames and the same credential).
2. PKIX covers a lot more use cases than OTP, things like Kerberos (PKINIT), TLS (TLS Client Certificates), SSH (PKIXSSH et al), digital email signing (S/MIME), code signing, commit signing, and more
3. The device is basically a second computer, so it can run software policies on it to do various things like if you authenticate incorrectly a few times in a row it can zero itself out, with OTP systems that has to be coordinated by the various systems validating the OTP token.