Yup, plus you have the issue of users gettng a new machine and being totally lost. Or owning 2 machines. I suppose you could help that a bit. i.e. have a cert

Yup, plus you have the issue of users gettng a new machine and being totally lost. Or owning 2 machines. I suppose you could help that a bit. i.e. have a cert used for authentication, if it is not present then ask for the users info and offer to create a cert for next time.