agree, red flag. it's easy to secure it by having the comp…

agree, red flag.

it's easy to secure it by having the company NOT hold any valuable data:

Use the data (face) on the phone to generate a reproducible random hash, use that as a seed to generate private key.

No need to store anything on a server ever.

https://twetch.app/t/18dbab20cb36723b0d4a6adc7bd403c6cd156447e941f75e2b4d1dbd6635058e