I think we agree. This is a broken application, built upon a sound technology. The card is perfectly capable of signing the transaction, and will only do so i

I think we agree. This is a broken application, built upon a sound technology. The card is perfectly capable of signing the transaction, and will only do so if the correct PIN is entered (smart cards can also be programmed to disable themselves after a number of incorrect PIN attempts). However the banks either don't know how to, or do not want to, run a public-key cryptosystem, so they don't ask the card to sign.