Currently we support several variants of EAP for ipsec remote access client authentication, but we should also support standard ipsec mutual x509 authentication. This is authentication mode "pubkey" in the strongswan config and functions in practice similarly to EAP-TLS, just without the extra EAP exchange.