That’s not my understanding of how it works. Your face geometry is used to allow access to a secure processor (trustzone/Secure Enclave/etc) which then signs t

That’s not my understanding of how it works. Your face geometry is used to allow access to a secure processor (trustzone/Secure Enclave/etc) which then signs the web token. Which is why the phone is the “something you have” piece of the puzzle here.