The Myth of the PKI
Do certificates require a corporate-wide PKI?
Certificates only need to be authorized by their own domain of discourse.
Corporate-wide secure email may need a corporate solution.
Craft logins to an OSS only require certificates for that OSS; no corporate-scale work is required (or desired).