It seems like one cannot unlock the screen with a different smart card then the one that was used to log into the session, or at least one with a different token id, even though they resolve to the same user (of course).
Is there any immediately obvious reason this might be? Is the token id cached somehow in the session? I would have thought that each authentication would have been independent.