Frederic,
SNC is designed to be independent of concrete credentials. Each SNC provider product comes with one or a set of supported credential types; in case of SAP SSO (the frontend part) and SAP CommonCryptoLib (the backend part which is installed with the NetWeaver Kernel) you have the choice of using Kerberos and/or X.509 certificates.
The same SAP CommonCryptoLib instance on NetWeaver can handle both peer credential types, Kerberos and X.509, in parallel.
A server to server SNC connection with SAP CommonCryptoLib must use X.509 certificates. Unlike end user clients, the adminstrative efforts to configure X.509 on both sides are quite low, and is completely independent of Microsoft domain services.
If your .NET client app uses SAP NCO for RFC and SNC, then you have the choice of using Kerberos or X.509 on end user side once you run SAP SSO Secure Login Client on such client. The backend component is already in place.
Any SNC product should work if configured properly. The question is what you need (not just today, but also in future), and what effort you like to invest in rollout, configuration and operation.
-- Stephan