[brownbat]

Here's the situation: adversaries are using a set of compromised credentials to fraudulently access a system.

The next step is revocation and reissuing credentials.

You cannot revoke someone's fingerprints. Or at least they'll probably object once you fire up the blowtorch.

Are you familiar with the biometric menagerie? http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=4...

Sorry that's gated, but tl;dr, there are marginal cases in biometric systems where some individual's data doesn't work well, or messes with the recognition/exclusion of others.