They did mention that they tested against photos, and worked with hollywood makeup artists to make masks to test the phone as well. The number they mention for the odds that someone elses face will match yours is 1 in 1,000,000. They also said that touch id has a 1 in 50,000 chance, so it is 20x more secure.(I say that a bit tongue in cheek) I would like to know how they crunched these numbers though.

It’s stored in the secure enclave locally on the device. They said it can’t be fooled by photographs and they tested it with “Hollywood mask makers”. It’s “one in a million”.

It's all stored locally on the phone. I don't think they mentioned whether there will still be a "panic" button which forces passcode unlock.

The "panic" is an iOS 11 feature, not phone specific in any way.