M2 — phone-biometric secret release. Enrol a secret, then run the approver and approve releases from the server.