[Aachen]

I don't think they meant respiratory masks to hide from your head being scanned, especially if the algorithm doesn't look at that part of your head.

> Even if you could write your sensor's face data into someone else's phone,

Since the keys presumably aren't retrievable from the hardware, it doesn't matter if there are random or intentional production flaws in the sensor itself: you need the original hardware anyway. You just need to trick it into doing the authentication. That's the part where biometrics are involved, the part where you present it with a username so to say. The rest is private key authentication.