This distinction will further blur with the release of NT 5. At that point, it appears to be a lose-lose situation for both the support staff and the users. The penchant for IS to select just one me thodology and shoehorn all users into it can have some expensive repercussions when applied to application logins. Usually, it isn't. The informed organization will work at taking advantage of the strengths of both, making them work together.
Digital certificates are the most powerful method for identifying people and systems.
If you're willing to put the user's private key on the CA, this makes the user's digital certificates portable. In general, single logon has been, at best, a poorly realized dream for most of us. Those that have tackled it have added to their support costs or to their system's complexity. But all that just might change this year. By deploying a digital certificate environment and joining Kerberos to it, you can create a powerful framework for single logon.