Whereas a failure of biometric identification on a single device is a surprise for which mitigation is feasible, the exposure or modification of such a central store has no obvious mitigation; once one record in it is shown to have been modified by unknown methods or parties, there can be no succinct scoping of how many records must be re-initialized from scratch.