[crispyporkbites]

If the token is signed you could validate it with Apple (or the vendor that implemented the face recognition on the device, eg Samsung, Nokia, pinephone etc).

You just need an open standard, you could even embed the url of the validating api in the token, so anyone could create their own Face ID provider.

[bfulgham]

That's precisely what the attestation section of the talk describes. This is all part of the WebAuthentication standard.