Keypassxc does it perfectly.

Everyone doing parallel biometric and password authentication on Linux today is either running two PAM stacks in parallel (which is meta-policy that kind of defeats the purpose of PAM) or just bypassing PAM entirely.