New commits have shown up in the AOSP code review under the label "Add face authentication framework," which seem to provide a bit more detail with regard to how Android face recognition could work. This is the same feature which was first spotted back in March, suggesting that the next version of Android might include native support for the security feature. The new commits appear to point to a system-level API which can be called to recognize facial features, which may indicate that it will be hardware-independent. Beyond that, the new code also seems to suggest that each Android device will only be able to enroll a single face. That would keep processing to a minimum and both response and unlock speed up.
While there isn't a lot to speculate on at this point, the former of those features would seem to suggest that the various traits face recognition recognizes could be partitioned. In short, that would make it easier for a given OEM to implement face recognition without needing to custom-build the solution around the hardware from scratch. For example, a dual selfie camera would be better equipped to handle a completely 3D template for a less vulnerable login and file access or an OEM could feasibly incorporate it with iris scanning included for even more security. On the other hand, a single sensor would make that more difficult to implement. Having the above-mentioned aspects separated would give manufacturers a firm footing to start with for their own unique hardware setup, allowing them to take advantage of more advanced or simpler features in their firmware. Moreover, by only allowing a single template, the system would likely be able to stack security - as with the iris scanning mentioned above - without overloading and slowing down the system.
Aside from those changes, the new commit adds an authentication manager and "FaceService," as well as adding the capability to TrustManager and Keyguard. It also modifies the latter two items to prevent duplications and adds a "BiometricSourceType enum" to track the "specific biometric method." Those add up to some substantial changes which could mean the new features will show up in Android P, though they could obviously be pushed back to another update if further changes are needed.