Personally, I'm surprised anyone trusts a mobile phone or its software for anything important. Malware is so prevalent on Android, half the androids are still vulnerable to StageFright vulnerabilities (and will never be fixed, just phased out), and I know that there are exploits for iPhones as well (because I'm familiar with companies who sell those exploits to governments - but I don't know the specifics of any exploit).

AFAIK, Norway and Israel are the only two countries that require an electronic signature be done by a certified secure hardware element. And I think that's the right way.