Another thing to keep in mind about PIV is that it's currently limited (at the standard level) to RSA-2048 max.

Would it be possible to make a custom firmware that support RSA-4096 PIV?