When we can verify everything about a person but recognize nothing—what exactly are we authenticating?