Touch ID stays off until a Mac owner agrees
Pull request 16360, merged into quattro, asks a Mac owner to agree before Touch ID turns on. Turning it on creates a Linux key store and advances a Secure Enclave anti-replay state that macOS shares, so the owner has to read what that means first.
Setup runs the platform's enable-fingerprint hook, after sudo, before fprintd is asked about the reader. A refusal or a failure stops setup with nothing enrolled. Off a Mac the hooks do nothing. A platform that cannot be told sets up with a warning, the reader that platform keeps off stays off, and any other reader enrols as before.
Saying no leaves fprintd and libfprint-git installed, because setup installs them before it asks. The prompt is about the Secure Enclave, not the packages. Removal runs disable-fingerprint after the prints and local files are gone. If that hook fails, removal continues and says the reader may stay on.
The pull request records that on a MacBook Neo, a fresh install from installer 2.3.8 with these three commands installed by hand, yes turned Touch ID on, enrol and verify passed, and after a cold reboot the lock screen took the finger. That run predates the resolve-first, re-authentication, and non-fatal-resolve changes.