Whether that's an issue depends on the threat model of the system you're building, and also the legal context you are operating in. In the UK, for example, biol

Whether that's an issue depends on the threat model of the system you're building, and also the legal context you are operating in. In the UK, for example, biological authentication and password authentication are both treated equally and you can be imprisoned for two years for refusing to provide either under RIPA legislation. Equally the US could (and IMO should) change the law to treat biological authentication as equivalent to password authentication when it comes to the right against self-incrimination. But besides that, a biological verification could rely on someone performing some sort of affirmative action (think "my voice is my password" type systems). Indeed, prior to computers, nearly all authentication was performed roughly in this manner but with humans rather than AIs doing the evaluation. In practice, the authentication part generally worked quite well (but bribing the authenticator was a good "hack").