We do both. Ssh keys are the backup if there's ever a kerberos outage.

Also make sure to deploy the ssh keys somewhere the users can't write for extra security. Don't allow them to control their own authorized_keys files! :-)