This is the part that loses me, my understanding was that this was only supposed to scan things offline, not collect any PII. Are they lying about not collecting the face scanned data?

There's two paths for verification, and the discussion on them is muddying things. There's k-id, which is the local-only age verification, and then there's a secondary process for places where k-id is indeterminate or their system flags you as possibly still being underage, and requires ID verification.

Previously, they handled this escalation path via Zendesk, which was breached revealing all of the messages with IDs.

Now, they're trying out Persona for this path.

There is no reason to trust them, and many not to.