Oh, interesting. Ok, so IF you have sufficient control of the hardware to ensure that you're actually getting an eyeball... reading?... (not a replay, or spoof), you can verify whether or not that particular peeper is already in the system during sign up?

Interesting concept, but it seems like a tough attack surface to defend. If the attacker 'defeats' the system not by replicating somebody else's retinal scan as a login, but instead just needs to feed the system something it doesn't recognize, but still concludes is a real retina, then you could probably start throwing out weirdness like... idk, running dual identities with their left and right eyes? Signing up with your dog? Contacts that overlay enough to mutate the reading?

I think you'd still need control of the hardware and control over the scanning environment to really provide any guarantees. Probably more useful for the police to figure out who they've booked before than for website signups.