Really nice article. I think the only thing I’d change is use GCM instead of CBC (in your biometric code).

And also mention the minSdk restrictions of using Tink.