Another, rather extreme, option would be to support hardware security devices that can store PKI private keys and perform asymmetric encryption within the device (i.e. there is no way to read the private key) e.g.
Whilst the system software is vulnerable this doesn't gain a lot (you're in Thomas' arms race): malware intercepts the transaction request and requests "please scan your fingerprint to sign transaction of $1"... then quietly presents a $1000 charge to be signed by the PKI token. Even TPM can't help if the software is hacked.
http://www.safenet-inc.com/products/data-protection/two-fact...
This would provide a pretty good additional "something you have" authentication factor.