Not necessarily true, you can do it with just a display (and two buttons) like the Trezor does[1]. You can probably even omit the buttons using this model:<p>1. Send message to sign over the wire<p>2. Display message to sign on the device&#x27;s screen<p>3. Send a message to continue or reject over the wire<p>4. Device displays scrambled pinpad<p>5. User enters PIN on the compromised computer, using a blinded pinpad (like the Trezor)<p>6. The blinded PIN is sent over the wire to the device<p>7. The device verifies the PIN, and if correct, signs the message displayed in step 2<p>8. The signed message is sent over the wire to the compromised device<p>[1] <a href="https:&#x2F;&#x2F;doc.satoshilabs.com&#x2F;trezor-user&#x2F;enteringyourpin.html" rel="nofollow">https:&#x2F;&#x2F;doc.satoshilabs.com&#x2F;trezor-user&#x2F;enteringyourpin.html</a>