Just in case it helps someone, a while ago I wrote a blog post with exact CLI invocations to set up a local-password-store protected by TouchID. If you wish, the encrypted password-store can be backed up and tracked with a Git.

> PasswordStore (`pass`) + GnuPG (`gpg`) + TouchID

> https://gurjeet.singh.im/blog/passwordstore+gnupg+touchid