> First, retina scanning output hash is deterministic - it is supposed to generate the same result for the same eyeball. So it can't be replaced with random number generation.

I don’t know much about retinal scanning. But for this use case, wouldn’t it be trivial to fake via something like different coloured contact lenses?