This could be (partially) remedied through periodically requiring the user to pair the key and phone (bluetooth, wifi?). It's kind of an annoying solution, but

This could be (partially) remedied through periodically requiring the user to pair the key and phone (bluetooth, wifi?). It's kind of an annoying solution, but it sounds like a bit of a security risk to just let someone permanently stay logged in to an app like that without requiring authentication every once in a while.