I'd put a key inside my app which then talks out of band to multiple devices (including maybe a trusted one?) -- e.g. "run app on the device, request input using the directly-connected PC, message tunneled out to my phone for confirmation")

A screen and 2-3 buttons would be nice, though; also a tamper-evident/tamper-responding package. But my main desired use case for this is a lightweight app-specific HSM so I'd just need to validate integrity of device before connecting it to host. USB Armory II is the main alternative.