Your brain is your key: Brainprints could replace passwords (binghamton.edu)

And you're supposed to change it every 90 days ;)

No, seriously: things you know and things you have can be invalidated. How do you invalidate a brainprint, a part of who you are? Ergo, you still need another (revocable) auth factor at the very least.