It's not what they're doing here, but you should be able to read the biometric chip using a phone and verify the data that it contains server-side (since it's s

It's not what they're doing here, but you should be able to read the biometric chip using a phone and verify the data that it contains server-side (since it's signed). Not sure how easy it is to get hold of the public keys though. Which also would be a nice feature if it could be implemented here, might be possible with WebNFC :)