You don't. I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open

You don't. I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open doors directly and supposedly stored no data locally in case someone smashed and stole it, or smashed and shorted the control wires (I believe it was RS-485 line level protocol WRT wiring) and a black box inside the secured area that contained our biometric hash data, logs, and a normally closed relay that could toggle and unlock the door when it felt like it. Anyway if the protocol and connection between the two black boxes could be monitored without breaking the DMCA, then you could verify the box outside does hashing and only 24 bits of data or whatever transport to the other black box that unlocks, rather than entire hand pix. Assuming there's no ATM-skimmer grade camera taped on the scanner recording the geometry of every hand for later abuse. The nature of security theater or snake oil is apparently unfixable failure modes don't indicate lack of effort or knowledge, they indicate the product sucks.