So how would this work in concrete terms? How will this stop bad-faith actors who will go out of their way to abuse/fake things? How does it solve the "BAP theorem"? You can't just sprinkle a term like "on-device biometrics" and declare that solves it.