If you want x509 support, you'll have to look at a commercial version of SSH. And, at that point, you would need to use a sftp/scp client built to follow their login process if they require an x509 ...

Certificate-based authentication is a cryptographic technique that allows one computer to securely identify itself to another across a network connection, using a document called a public-key ...