The issue is you want cert based auth that is easily revoked. So you set up very short lived certs Yubikrys and the like is then only used for exceptional cases .