Certificates are great, but not strictly necessary until you need to distribute thousands of keys. maintaining an authorized_keys text file is much simpler than running a CA.