> How do you prevent malware running on the pwned laptop from asking for an ephemeral cert to be issued?
If you have malware capable of code execution, restricting the ability to issue one command is not going to be a meaningful control, especially with something like a physical touch which most users are just conditioned to accept, or can be trivially phished into accepting.
> plenty of time for malware to ship the cert back to a command-and-control server.
If your infrastructure cannot distinguish legitimate traffic, or you do not have a defensible network perimeter, again a physical touch is not going to be meaningful; it is not the panacea you are looking for.
