You do not replace your identity provider to remove passwords: add a person-bound factor through OIDC or SAML where it matters most, starting with privileged access, and expand on your own schedule. Administrator photo provisioning processes the image transiently in the minting service. The licensed on-premises webcam method is the deviceless alternative to phone sign-in; it runs inside the customer deployment, on secure terminals, because unsecured terminals expose webcam capture to injection attacks.
Recovery binds a replacement device after verified-mailbox PIN and new device-key checks; the original enrolled face is still required at sign-in. If the mailbox or enrollment reference is unavailable, the supported administrator recovery process applies.
KYA lets a verified human authorize an agent certificate with a defined model hash, scope and expiry.