EAP-TLS is considered one of the most secure EAP types, but:

It requires a Public Key Infrastructure (PKI).

Every client device must have a unique certificate, adding to administrative burden and cost.

Incorrect:

A. Roaming speed is not inherently slower with EAP-TLS if supported by the infrastructure.

B. EAP-TLS protects client credentials; passwords aren’t even used—it uses certificates.

C. EAP-TLS does establish a secure tunnel—it's the original TLS-based method.

D. EAP-TLS is vendor-agnostic and supported by most enterprise WLAN infrastructure.