[jki275]

Signing on the hardware is pretty much the only way to safeguard the keys. PCs and phones have an attack surface much too large to properly secure.