Biological credentials could work even without revocation if you use a lot of them simultaneously. It would be like asking for many usernames that are semi pub

Biological credentials could work even without revocation if you use a lot of them simultaneously. It would be like asking for many usernames that are semi public instead of a username and password. e.g. multiple fingerprints plus iris scan plus voice print plus facial scan. So even if a few get stolen and successfully replicated somehow to fool the system into thinking it's a living person, it still won't be enough to steal the identity.