Paul,
I was also under the impression that the Stripe implementation was fully tokenized instead of the current setup. I believe I had a open ticket about this back in December. I agree with @iamp, that it is likely, there are other installation that are using Stripe unaware of their PCI compliance obligations. So here is my vote for having the stripe module fully tokenized in Blesta.