Because then you need to do Kerberos...

If you already have Kerberos, fine. If not, certs are way easier to implement & more flexible.