I was thinking more a local keystore, someone has to look at the sensor for 10 seconds for it to be registered to the device - maybe do some simple blink pattern match or something to avoid picking up "starers" or, taking a creepy direction, people who are asleep. That way you give your approval per device rather then a blanket "yes" or "no"