Adding a "duress" password with PAM Duress

IMO the legality (or morality) of however it's used is separate from the basic mechanism itself. Situations of duress could also occur in government, infrastructure, workplace, or home settings, and the aggressor needn't have nation-state resources nor any particular authority behind their coercion.

Without modifying your login daemon, you could also set any manner of innocuous canaries to initiate various processes throughout your dotfiles. AFAIK the legality of dotfiles has never yet been called into question, but who knows what wonders the future has in store. :-)