Giving my finger and face prints to the browser, the software with the biggest attack surface in the world, connected to internet no less, feels off to me.
Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.
There have been some past complaints here about how Apple used to tie their fingerprint sensor into the secure element (third party folks couldn't substitute them). I actually liked that rule from a security standpoint, but obviously unpopular here. Same approach with faceid / touchID for the web.
https://manuals.info.apple.com/MANUALS/1000/MA1902/en_US/app...