Your agent can propose a transaction. It can't sign one.
Your keys stay in the secure element. Keycard Shell decodes the transaction on its own screen, and nothing happens until you enter your PIN and press OK.
You can set this up in 2 minutes with a MCP.