Point 2 could be related to it being usable offline, which necessitates a handshake to ensure it's removed from the old device. HN loves to say things should just work offline, but when the thing is actually part of a network (like a payment code) it's far from trivial to do so.