I don’t see any mentions of what you define as “spoof-proof.” Are you performing a liveness check [0] ? Eg can I hold a picture up of someone else’s face, or commandeer the camera feed to play a video of my choosing?

[0] https://www.liveness.com/