A hospital is deploying 802.1X authentication for its enterprise Wi-Fi network. Security requires that both the client devices and the RADIUS server mutually authenticate using X.509 certificates, eliminating any reliance on user passwords traversing the wireless link. Managed laptops already have client certificates provisioned via the corporate PKI. Which EAP method best satisfies these requirements?