It isn’t US Boarder Control running the facial control system, its Delta, Southwest, or anyone else, which has implications about the privacy of the biometric data, that up until this point hasn’t been collected by Airlines, only Boarder entities.
That said, in order to boot strap this system, Delta et., al. would have had to either; 1. Build their own database of biometric and facial data that they believe was reliable (unlikely) 2. Get a full and continually updated copy from CBP (Probably noisy) 3. Use an API made available by CBP that acts as a Biometric/Facial oracle.
I’ve heard rumblings that it’s 3, but I can’t cite anything to back that claim up, so grains of salt.