Currently "PIN always" is implemented as a flag that "consumes" the PIN entry on usage of a "PIN always" key. As outlined in #5, the true behaviour is to enforce that the APDU command directly before the slot usage was a VERIFY, and produce an error on any other condition.