The certificates have an expiration date, so if something goes wrong on that end at least it will expire after some time. Also, this takes care of role-based access - this you might not have with an authorized_keys file solution?