Comment by mppm

Key distribution is (as always) an important, but solvable problem. There are some tradeoffs involving centralization vs cost of replacement, but those apply generally, not just in this particular case.

As for replay attacks, that's where the button press comes in (like on a hardware security token) -- the key only responds to challenges within a second or so of a button press and the car sets a similar timeout for validity.