The Apple Watch manages to handle RTT measurements to prevent exactly this attack. You don't need complexity in the FOB; the car starts the clock, sends the si

The Apple Watch manages to handle RTT measurements to prevent exactly this attack. You don't need complexity in the FOB; the car starts the clock, sends the signal, measures the time taken to reply. If it exceeds some threshold ignore the response. There is no way to spoof this if the request/response itself is using proper cryptography.