Also, the link ought to be fully authenticated and end-to-end encrypted. And one could require the user to press a button on the key fob.