Oh and just in case anyone sees this and decides to do it: at least on the corn profile, disable fingerprint device unlock. You can still enable biometrics for in-app unlock, but disable it for decrypting the user profile itself. This is a per-profile setting. And end your sessions when switching between profiles so they stay encrypted when you're not using them.