OK, there was an issue in 5.3.3 where we created the keychain with extension ".keychain" which has been changed to "keychain-db" on 10.12+
During login, system detect old extension and help us to migrate to the new extension, then adding a new reference to the keychain search list, 
and every login we add the old extension back and system migrate it again, therefore creating multiple references in the keychain search list, hence multiple entry in the status menu.

This is fixed in 5.4.x already, it won't add new references to the keychain search list, but it won't fix the messed up keychain search list which contains multiple references to the same keychain, therefore support is still seeing duplicated entry in the status menu.

To fix this, after upgrading to 5.4.x+

• Login with smartcard
• Open Keychain Access
• right click token-protected keychain -> Delete Keychain "token-protected" -> Delete References
• repeat this until token-protected keychain no longer exist.
• log out and log in again and the issue should be fixed.