People who understand society care about it. When you employ someone you take on a certain responsibility. You can't negate that by pretending that you're in an equal power relationship.
Consider a Schindler's List type scenario. It's a crime to help a Jew escape. Now mostly I believe in the rule of law and if I broke a law because I thought it was justified in that particular circumstance I would accept my punishment.
But in that scenario, accepting my punishment would mean I couldn't help others.
These are 20 year periods, not decades. How did you think there were 13 years in the previous decade? It would be 18 vs 13 if every year up to 2039 went over 30C.
Yes, you can do it by MAC address instead but that can be changed so you can spoof a legitimate device.
Edit: oh wait, you mean have the applications check the certificate? Yes, but then you need support from the application. Does your printer do that, for example? You need to make sure everything does. You can of course do both.
Basically staff machines get a certificate to present to the server and the server controls the network.
So, if your machine does nothing, it's on the guest vlan and has limited access. If it presents a valid certificate that network port is reassigned to the staff vlan and you get full access.
If someone leaves, you just revoke the certificate and they have guest access again.
In everyday life the human is less careful, and the machine costs 1% of the human.