Author here; #3 also defies the use-case for a duress word. The attacker is supposed to be presented with what appears to be a normal login scenario while in the background sensitive data is being scrubbed or even have the routines remove the pam-duress module completely so there's no evidence there was a duress routine in place.

Real law enforcement agencies would also simply confiscate the device and hand it to a forensic team to pull a "golden image" from it to work with in lieu of a user session.

So in the UK they can put you in prison for life without being charged or found guilty of any crime unless “they believe you”? Any source on that?

It's a theoretical thing under the Regulation of Investigatory Powers Act, IIR. It hasn't been tested. In practice under the law it'd probably be a stretch under a sensible judiciary since you can't prove a negative and thus can't prove you don't know something.

In a number of countries there is a defined offense, like in Australia if they don't believe you they can jail you for six months under the Cybercrime Act, 2001, or possibly 2 years (failure to obey a court order under the Crimes Act, 1914).

A story from the US:

https://nakedsecurity.sophos.com/2016/04/28/suspect-who-wont...

Depends on the crime, I guess. If you face execution for murder or treason because of the data on your hard drive, life in prison is an upgrade.

This is why I don’t keep evidence of committing murder/treason on my computer.

Evidentiary tests may change.