“A Pluggable Authentication Module (PAM) which allows the establishment of alternate passwords that can be used to perform actions to clear sensitive data, notify IT/Security staff, close off sensitive network connections, etc if a user is coerced into giving a threat actor a password.”
Give the border agent or the mugger the duress password, and the machine quietly wipes what matters and calls for help. Bank alarms have had this for decades. Linux logins got it from one developer’s side project. Phones, where the threat is real every day, still don’t offer it.