Yeah thinking about it more it's probably a cheek swab and not a blood prick. And yeah the card would be the more regularly used 2FA. The DNA test is just for when you lose your card.

As to doing it by mail, that may be potentially doable, but one would need to think through how to prevent e.g. stolen saliva, MITM mail sample interceptions, etc.