This isn't necessarily true. At Clef(clef.io) we're storing keys on your smartphone and they're protected by a PIN wall. We used PIN-based encryption to keep a

This isn't necessarily true. At Clef(clef.io) we're storing keys on your smartphone and they're protected by a PIN wall. We used PIN-based encryption to keep a rooted device from being vulnerable to attackers. Generating the keys from the PINs take long enough to make a brute force attack time consuming. Since users can deactivate their devices remotely if they're stolen (so the public side of the key pair is deleted and the private side is worthless), even in cases of device theft, their identity is protected.