Countersign moves the approval action to a trusted device that the agent cannot compromise; as an independent trusted computing device with a secure element and biometric capabilities, a phone is suitable for taking on the approval role.