PCI-DSS is incredibly aggressive with key management considerations. They get down to radio frequency concerns in pin pad hardware, etc.
It took us ~2 years of back & forth with various parties & auditors to get per-client exclusions for accepting end-customer debit PIN codes in-branch on an iPad screen. These banks do not have fully-compliant solutions and must have exceptions on file.