However, SET itself is not an app. A consumer will not be using SET, they will use a browser which has implemented the SET protocols. This is significantly different. SET will be one tool developers of merchant and card holder apps will have access to. None of this matters either if there isn't physical security, and many of the other basics.
Security has to occur at all levels.
Many of the levels already have tools availabole for them. SET just addresses a new level which hadn't been properly 'secured' previously. Once again I agree that the limits and domain of SET should be explicit in any reference implementation, however that is for the benefit of developers to know what else they should use, not for end users. By the time a card holder or merchant ties into an SET supported system, the actual protocols should be transparent. Imagine a year from now, and SET is actually implemented.