We need to basically get rid of all exportable tokens. Require signing of all requests by a hardware backed key.