The same way as MFA works. Every time the key generates different token that can't be reused. This renders replay of signal useless.