I keep having to point out that assuming this is built on existing infra, FaceID is just the username. Everything is end-to-end encrypted. You can't get the data onto a new device the first time without the encryption key which Apple doesn't have.
You need your iCloud login/password and also (I think) an existing device which has the key to approve the request.
This is literally no different than how it works exactly today when restoring an iCloud backup onto a new phone, except imagine it can happen as a polyfill so it looks instantaneous instead of the 2-4 hours it seems to take today.