GAO’s audit stemmed from concerns expressed by Congress and the public over the growing reach of identity-proofing programs that involve biometric data.