Early in the article, the author says that a card is something you have, a public identifying token, and, since it can be stolen, it should require something to

Early in the article, the author says that a card is something you have, a public identifying token, and, since it can be stolen, it should require something to unlock it. Later, in the hospital example, he suggests that a private key stored on a smartcard works as an authentication token. Seems to me that a card with a private key can be stolen just as easily as an ATM card.