Is there any reasonable way to make this work that doesn't involve the company keeping plaintext copies of Iris scans and/or retaining the ability to arbitraril

Is there any reasonable way to make this work that doesn't involve the company keeping plaintext copies of Iris scans and/or retaining the ability to arbitrarily reset account keys on the ledger (such that users have to trust them to behave honestly)? What happens if a modified Orb is used to dumo the scans and then later trigger a fake reset?