Are you using javacards? I've actually implemented something similar to Rod's proposal with the ntag424 DNA (the same NFC chip as in a bolt card) and a remote signer. Works well.