It would be quite straightforward to make your biometric identity a public private key kind of setup.

How would that work? Maybe the biometric part acts as a domain name from which the public key might be downloaded? Who is the custodian of face-public key pairs?