Manual Keying, but by a cost, you need a CA server for the client registering, it depends a lot in the infraestructure size, wheter you have few remote nodes establishing security adjacencies between them (pre shared is the recommended), or hundreds even thousands ( manual keying is the recommended).
so It depends about what you have, and what constant, partil administration you want to give it.
