The app key would need to stay the same, but I can't think of a mechanism that would deny one app trying to pretend it's another. Also the fact it doesn't emul

The app key would need to stay the same, but I can't think of a mechanism that would deny one app trying to pretend it's another. Also the fact it doesn't emulate smartcard means every single software supporting it would have to make a special client so yeah, that's a problem. "Just" smartcard allows for at the very least GPG signing and SSH agent without much fuss, and also HTTPS client cert auth