There is a way to do smart card authentication to a LAN,where you would not be required to enter a password to connect and everything would be wpa2 encrypted. I implemented it before in a MS environment. It required a ton of painful configuration. The downside, even though it worked, was that it was pretty flaky and refused to stay connected for certain users when we rolled it out. Ended up scrapping it for a wpa2+password setup with a better password than the old one.