Comment by rdl

Long-lived keys should not be unprotected in memory/execution environment of general purpose hosts.

I'd take an RSA 2048 smartcard before an RSA 4096 on my Mac.