I have a feeling that "Is pam_duress.so configured in any file in /etc/pam.d, and if so turn on a big red light" is a pretty trivial thing to add to those "plug the person's computer in here and have them log in to their machine to decrypt everything, otherwise they won't go through customs/leave our dingy bunker" solutions.
These duress passwords seem to be for kind of contrived scenarios, to me. Either your threat model is "someone breaks into my hotel room and steals my laptop", in which case it's useless, or "The $OpposingSideSecretService got me and hits me until I give them my password" in which case it seems to be equally useless.
These duress passwords seem to be for kind of contrived scenarios, to me. Either your threat model is "someone breaks into my hotel room and steals my laptop", in which case it's useless, or "The $OpposingSideSecretService got me and hits me until I give them my password" in which case it seems to be equally useless.