It's a mistake to assume that the security must be embedded in the key.

It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.

Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).

The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.

[1] https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_a...