Like another user pointed out they could just use government issued ID and give out tokens based on that. There is no need to scan people's iris.