As a sibling comment pointed out this was a reference Homeland Security Presidential Directive 12 (HSPD-12). The results were that the vast majority of systems

As a sibling comment pointed out this was a reference Homeland Security Presidential Directive 12 (HSPD-12). The results were that the vast majority of systems did not use passwords. You can check out the status over time by googling "HSPD-12 Status Report" (no quotes) and check for the various agencies that fall within the US Executive branch. The DOD led the charge with the DOD Common Access Card (CAC), which became standardized (more or less; there was the GSC-IS which did specify the CAC) as the PIV in NIST SP 800-73, and this is what practically everyone uses today. The PIV is just a smartcard, like your favorite chip-and-pin card (ISO 7816). Which is just a tiny computer you send datagrams/packets (APDUs) to request that it do work, and it sends you back responses. It has your private keys on it, as well as some certificates for you to present and that's pretty much it. The vast majority of deployments people use this in combination with some other tools. For example with PKINIT with Kerberos, and then most authentication/authorization occurs using the Ticket Granting Ticket (TGT) you get with from Kerberos. Direct authentication using TLS Client Certificate Authentication is also used in some cases (since it requires less infrastructure). SAML IdPs are also used, usually in conjunction with Kerberos or TLS Client Certificate Authentication.