Password protected keys (edit:certificates), yes, but not regular user/password no matter if it's LDAP backed or anything else... (but I think you can do password and key, but I need to check docs)

I'm in a meeting and drawing a blank on what the primary reason was for avoiding password-only... I'll update if I can remember the reason besides "passwords are easier to crack"

LDAP is nice to grant and revoke access and have passwords in sync with the computers at work.

Maybe the certificates could be stored in LDAP.

Almost any decent enterprise identity management solution (read: Active Directory, FreeIPA) includes user certificate management in some fashion; or if you want a separate CA for VPN access it's not hard to write a couple scripts to generate user certificates and revoke them as needed.