> 2. Mobile consumer hardware is sufficiently fast for the application > operations (eg. Cryptographic operations)
You are right here. It is possible to emulate a card using mobile phones. We've been able to shim/emulate any card for much longer.
The thing is: To connect to the payment system you need a certificate. And you simply don't get it unless you can prove that you have all kinds of security measures applied.
For android and apple, the actual payment stuff runs inside a isolated little micro-controller which has been certified and is temper proof/protected. This little thing is fortified so far that it will destruct itself when you try to open it up. There are alarm meshes, light sensors and much more inside the chip to detect any intrusion just to protect the certificate.
If you don't have that security, the payment providers will deny you their certificate, plain and simple.
You can build your own thing using card emulation via apps, but you will take all the risks.
How it works in practice is the following: These temper proof micro-controllers can run java-card code. You can write an applet for them, get it installed (if you have the key from apple/google - not easy). Then install it and you have a two-way communication: Your applet inside the secure world communicating with the payment world, and your ordinary mobile app showing things on the screen.
