Anonymous credentials with biometrically-enforced non-transferability