Hardware-generated, one-time encryption keys ensure that biometric data remains entirely within the host’s trusted execution environment, where it’s available only to processes known as trustworthy.