To what extent can we verify the identity of a particular mobile device, over NFC, in an entirely transparent manner?
Consider the following situation: A large organization currently handles access control with ID cards, which must be scanned for entrance into protected areas. However, for various reasons, they desire to move ID verification to a phone-based system. Individuals would scan their phones, using NFC, to verify their identities. (Yes, there are many drawbacks to this approach, along with some benefits. For the purposes of this question, please assume that the transition is inevitable.) Furthermore, the organization wishes to only allow each member exactly one device for identification. It should be prohibitively difficult to spoof the identity of one device with another device, even for the owner of both devices. Put another way, it should be nearly impossible to duplicate one ID across devices.
With proprietary software, this is somewhat possible, as the organization can install keys that are unknown even to the individual user, and/or force the phone to generate its certificate based on its own IMEI. But what about in open-source software? It seems that any private key could just be duplicated to other devices, and IMEI's could just be copied over. Yet, as an end user, I would much prefer having an open-source security option on my personal device than proprietary software managed by the organization.
The best idea I've come up with, so far, was to sign each unique identification attempt with the private key of the device's SIM card. As far as I know, that private key is difficult to access and sufficiently unique to each device (or, at least, to each SIM card). Yet, I don't know enough about mobile programming to say whether custom apps could easily get the SIM card to sign something. Additionally, I understand that a program could forward the identification request from a secondary device to the original device, then return the signature back to the NFC reader, though perhaps making the sign-in attempt time-sensitive could help that to some extent.
So, in a nutshell, is there any way to easily verify a device's identity in an entirely open-source, transparent manner?
Additionally, if there is any open-source software already available for this, I'd love to hear about it.
If this question is better for security.stackexchange.com, please let me know; I'd be happy to move it over. Many thanks.
Edit: If not the SIM card, I'd love to hear alternative ideas. For example, I considered sending a text to the device for each authentication, but the time delay and reception requirement would be prohibitive.
Edit 2: Yet another option might be to use the secure element of the NFC chip itself. Is it easy to get the NFC chip to identify and cryptographically verify itself to the reader (e.g., by signing a prompt from the reader)?
Edit 3: For context, this is a university setting, and the end-users are students. They already have NFC student ID cards, but they've been lending them out, against university policy. The university wants to move to a phone-based system to keep them from masquerading as each other as often (yes, it will still happen, but it will likely be less common, as people like to keep their phones close). Consequently, they want the identification/verification information locked to one device. I am curious whether this could even possibly be done in an open-source way, as I wouldn't want my university installing a proprietary app on my phone. Biometrics are similarly a too-invasive option, for my taste. It's an odd situation, to be sure. I'd personally prefer to stick with ID cards, but if the university is moving this way, I want to see if it can be done non-invasively and transparently.
Final edit: Thank you to all for your useful answers! I selected the answer that I believe best aligns with open-source principles while providing a practical solution. Now to make an open-source HSM company.... Thanks again!