Access control cards and readers long ago replaced mechanical locks and keys for enterprise security. Now, those plastic cards are giving way to mobile credentials that communicate with readers using a smartphone virtual key.