Why not just use Kerberos?
If you already have Kerberos, fine. If not, certs are way easier to implement & more flexible.
For client certificate, the fallback can be long-term certificates, locking up in a safe, that should only be opened when all other ephemeral certificate fail. I think this is less risky.
The fallback certificate is only client-side, and can be keep offline/air- gap from the main credentials.
You only need to get the CA to sign the fallback cert.