Certificates instead of RADIUS for Remote Login Authentication (Cisco and others)

Friends,

Security is asking us to switch from RADIUS to certificates for administrative login to network devices. This is NOT for IPSEC or SSL VPN, just for device administration (ssh vty login, enable 15, etc.). Do you have any experience with this and can you describe any concerns or pitfalls you encountered? aTdHvAaNnKcSe!