The xz/ssh back door made it into Debian testing, So I felt I should wipe and reinstall.

Debian has had a rolling release for ages.

darktable used xmp, and that looks like an alternate metadata format, it looks like exiftools might be able to work with the xmp standard, and it looks like there’s some face tagging features in xmp.

https://photo.stackexchange.com/questions/106410/how-does-xmp-define-the-face-region