I think X.509 and Kerberos are pretty good actually—compared to many of the alternatives on offer.