Windows Smart Card Logon On Stand Alone Machine

I just want to share with you my thoughts about smart card authentication implementation in Vista. I know that smart card logon, also known as strong authentication or two- actor authentication, can be performed on a machine that is connected to a domain. And in Vista SP1 it's been added the support for biometric factor authentication so that, with the appropriate security tokens, strong three-factor authentication can be performed through Kerberos on machines connected to a domain.

Said that I really can't understand why Microsoft doesn't give a standard option, included natively in her oss, to enable strong authentication in stand alone machines that are not connected to a domain. I try to explain in details what I mean. It happens often, for security reasons, that companies have stand alone pcs not connected to the internet and to the company domain. From my point of view achieving a strong authentication on a stand alone machine is not so complicated; Let's think at this scenario:.................