That assuming you know the algorithm they are using for the encoding of the information on the card. I seriously doubt they store the lengths of your index and middle finger in plain text format. It's probably a single number that's either a "check digit" or perphaps some number that represents the added length (of undetermined unit of measure) of the two fingers, etc. If banks can securely encode ATM PINs on cards, I don't see why Disney can't do the same sort of thing with APs.
There's a MAJOR incentive for them not to store such data locally... cost! Setting up and mantaining such a database would cost money and provides no benefits over storing the data on each individual card. Plus if the DB went down, that could mess things up at the turnstiles. Another reason why I don't think the data is stored locally, then you need a replacement card you have to show your photo ID. If the authenication info were stored centrally, then all you'd have to give them is your name and address and they could just hand you a new AP and let the turnstile determine if you are who you say you are.
