I assume they are solving this with secure enclaves creating one-time signatures.