wanting your biometrics like pictures of your face, your fingerprints, et c to be secret is a code smell for someone who doesn't know how to threat model