But Dave can only use the capability if he has Bob's private key. That's why we need keys.
One of the more complex aspects of OCAPy design vs the we do things now is that in a fully ocap world, the token wouldn't just be a string, but possibly a reference to a living object that Alice owns.
Then the trade (and any use of the capability) always goes through Alice.
That's why you don't need crypto in a real OCAP world.