Not to take away from the accomplishment, but hopefully the "selfie auth" isn't considered the penultimate verification. With no social engineering, just finding a public photo of someone, one could composite a short video that would be very hard to distinguish from reality.