As called out by the spec, the API currently reveals fingerprint-sensitive information about the user's device, in a way thats not gated (i.e. isSessionSupported). I'm not sure if this is 2 or 3 bits b/c its not clear to me if inline ever returns false.

I think the best solution here would be to make isSessionSupported gated behind the permission too.