GrapheneOS doesn't support face unlocking right now, but they have a useful two-factor unlock option that requires both a PIN, and biometrics (currently a fingerprint on Pixel devices) to unlock the device while in AFU. It also allows you at the same time to use a long passphrase in BFU.