I'm assuming based on the demo video that the private key is encrypted via the "CVC" code. Not great security but enough that someone would need at least a little while to brute force. Perhaps a solution where you only load a little cash onto it
No. It's a signed message.
But if I replay the signaled message and have the code? I must be confused how this works.