[MichaelZuo]

Biological credentials could work even without revocation if you use a lot of them simultaneously.

It would be like asking for many usernames that are semi public instead of a username and password.

e.g. multiple fingerprints plus iris scan plus voice print plus facial scan.

So even if a few get stolen and successfully replicated somehow to fool the system into thinking it's a living person, it still won't be enough to steal the identity.