Haven't we already established that the security implications are minimal (practically non existent)? Or more accurately we are waiting for a sensible reason why the existing system is beyond the pale.
I'd be astonished if someone couldn't already clone our season cards. I bet if my wallet was stolen the thief would take my Mastercard, American Express card and Visa debit card and bin my City season card with the rest of my wallet's contents. I don't think security is the issue here.
(((Not relevant at all this, but I'm also a Microsoft Certified Solutions Developer, and an Amazon Web Services Certified Developer.)))