"You could even spawn a process to remove the pam_duress module so the threat actor won't be able to see if the duress module was available"

This scenario was considered by the author