But that does not protect you against a compromised OS.

I don't get it why a simple USB key signer needs to be do pricy.