Who said anything about biometric data in the cloud? This doesn't need to work the same way the first time you see a device as it will work the second time you see it, after having fully authenticated the first time.

So, it doesn't have to alter the security attack surface or really even a major change in the secure element.

Someone from Apple should just reach out, the design is not simple but it's absolutely workable.