We will implement it in Keychain / Keychain mobile so that you'd need double signing ( extension + device) to validate active authority operations.