When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that

When done correctly, fingerprints are both something you are and something you have: The fingerprint data should reside in and work only to activate an HSM that then proves possession of an attested key pair. That way the HSM (and the device it sits in) is your something to have.