My example is still just as good if the ID holder is complicit. But also, this on-device fingerprint MFA would presumably be fairly bypassable. E.g. just glit

My example is still just as good if the ID holder is complicit. But also, this on-device fingerprint MFA would presumably be fairly bypassable. E.g. just glitch the device to extract the private key. ... and of course all the power hungry / extra complex ZKP machinery means less resources spent on preventing glitch attacks.