Wouldn't it be better to have the NFC tag sign the event, keeping the key material even out of memory?