Each of the three can be in completely separate, isolated locations. Apart from dictionary attacks, standard Unix passwords are usually a secure system. Various user access levels and periods of validity can be assigned to students by adding them to the certificates. The certificate can contain more information than just the student's name and ID number. Any kind of information that's worth keeping track of can be put into it.
Students have instant access to the computer lab once they've received their certificate.
There is no delay waiting for a database to be propagated. Since the certificates are in plain text, students can see at a glance if the certificates are correct, if they've expired yet, etc. This should make the system user-friendlier, and also limit the amount of assistance needed for help desk calls. There would never be any question about whether a certificate was still valid, issued for the correct person or contained the correct information. This scheme reduces the security requirements in the labs, but increases the precautions that need to be taken in the Field Staff's offices.