A system-wide key makes revocation a much uglier operational problem, because if that key leaks you don't just have one enrolled user to reissue, you have the whole template population. The upside is de-duplication becomes a real database problem instead of a per-subject linkage problem, which is probably the first place this would get used.