I've not researched how this works, but this definitely feels like one of those things where if you dig deep enough into it, it boils down to "we verify your 'humanness' by checking that there's your biometric data signed by our private key, for which the public key is hardcoded everywhere, so trust us please".