Whilst the system software is vulnerable this doesn't gain a lot (you're in Thomas' arms race): malware intercepts the transaction request and requests "please

Whilst the system software is vulnerable this doesn't gain a lot (you're in Thomas' arms race): malware intercepts the transaction request and requests "please scan your fingerprint to sign transaction of $1"... then quietly presents a $1000 charge to be signed by the PKI token. Even TPM can't help if the software is hacked.