Wait, the match-on-sensor devices don’t have a token (hash of fingerprint or whatever) associated with the actual enrolled fingerprint that the host stores? If

Wait, the match-on-sensor devices don’t have a token (hash of fingerprint or whatever) associated with the actual enrolled fingerprint that the host stores? If there was one, then a fingerprint enrollment would only work if the host had the token. IMO this should work a lot more like U2F: the host stores an opaque blob containing the encrypted biometric data, and the device would decrypt the blob and verify the fingerprint. Heck, this plus a proof that the device was able to decrypt the blob would defeat all three attacks.