Yes I understand that but having keys ONLY on a hardware device is never really a great idea in my opinion, unless I suppose if you're doing regular checks of all of your devices which in itself increases risk of leakage.