you can't rotate biometry if its compromised
Beats having to dreg up my high school year book, social security card, birth certificate, and high school transcript (None of which are actually inspected of course).
How do you defend against replay attacks?
Once you verify they are who they say they are, you can do a second step to verify they actually intend to do some secure action.