Let me clarify: when I meant two factor, I mean both. You need both the print AND the pin to unlock. So its more convenient than a full passphrase (for first unlock) but still requires knowledge not just biometrics.

No, this preserves the phone in an “after first unlock” state. They specifically dont want a phone to reboot or shutdown because then the encryption keys get dumped from memory and require the password to decrypt the keys.

You can disable. You can also two factor it e.g. fingerprint and pin, with also a long password for BFU.

I never died says he!

True. But I’d still rather have a TOTP setup.

“Unsigned code detected. Booting in safe mode. Flushing is disabled”.