The alternative is pushing plain public keys over an authenticated channel. You usually don't need the complexity of X.509.

That being said, the aforementioned authenticated channel will more often than not be TLS, which does happen to rely on X.509.