You could make it easy to ban on children's devices, rather than having websites do it. At the moment you either have a small set of allowed applications, which is fine for younger kids, or domain-list filtering which is unreliable, hard for parents to set up (and not that hard for kids to get around). There are many ways to improve the situation – I think websites should have to attach metadata about the content being served, browsers should use this to apply a device policy, and devices should make it easy to configure basic rules on first setup. People aren't asking specifically for hardware-attested facial scanning