Funny enough I recently implemented touchID for my company (Mustbin). The local authentication framework APIs only provide a place to store data. In our case

Funny enough I recently implemented touchID for my company (Mustbin). The local authentication framework APIs only provide a place to store data. In our case we use touchID as a secure keystore for client side decryption / encryption keys, certificates, etc. If you don't have a touchID device we fall back to storing keys encrypted via passcode and also protected by the device hardware encryption (the data protection API). If someone where to hack the app to bypass the touchID window you couldn't get at the data since it is encrypted at rest. A wierd oddity of the local authentication framework is that if the user deletes the application the keychain isn't deleted, so if you naively delete and reinstall the app you get back old keydata :(