Location is learned from the device's own sensors and signed in hardware. Users can leave their VPNs on.
Left: what the person sees in your app. Right: the SDK trace at the same instant. The tap shown here is the binding, once. After that your policy decides: the device can answer silently in the background, which no second factor does today.