[proksoup]

Could you say more about those things they should be doing?

I'm naive but it doesn't seem trivial to me.

[rachelbythebay]

Round trip times? Can't cheat the speed of light, assuming you can't spoof the transmission.

[mirimir]

Yes!

Also, the link ought to be fully authenticated and end-to-end encrypted. And one could require the user to press a button on the key fob.

[kileywm]

The car could log the signal strength of all successful auth attempts from the key fob and determine an acceptable range. Anything outside of the acceptable range could then require use of the mechanical key (for those fobs where the mechanical key is built in) as a precaution.

Fobs could require a 'wake up' key press after a certain duration of inactivity.

Fobs could have a physical switch on them, enabling an airplane mode.

These ideas all give up some manner of ease-of-use.