If you're going to use only 1 of the 3 factors you can use to authenticate yourself (what you **have**, what you **know**, and what you **are**)... what you **are** is, surprisingly, the weakest.
Secure things with custody, and if that's not possible, then secure with secrets that you can custody.