It does have the downside of requiring "trusted computing" (aka iOS and Android) on the client though.

Same as with NFC credit cards and similar auth mechanisms. You need hardware and OS-backed encryption that is tamper-proof.