Hmmm... Can't pam_duress be used to fix https://xkcd.com/538/ ?
For such scenarios plausible deniability is what you want. Ideally, you need a whole parallel system which plausibly appears to attackers as if it is legitimately authorized/decrypted. StegFS is an example building block for such systems.
If they know you work on breeding war rabbits, you better have some fake files with records of failed attempts to breed war rabbits and your real files hidden in deeper layers.
An HSM can even enforce policies like rate limiting brute force attempts and/or erasing itself after too many attempts. It could even support a duress password which immediately erases the keys.
Without the ability to clone the HSM, the attacker doesn’t get a “second chance” if they attempt to use the duress password.
Assuming they will always have access to the underlying system being protected is missing out on a huge range of security issues.
If they are using the pipe, then anything that isn’t what they’re looking for will result in the pipe.
They aren't murdering everyone whos phone / laptop they check at a border. It would be perfectly fine to have an encrypted disk drive that presented different contents based on what password was used to unlock for instance.
And with something fully arbitrarily scriptable like this, it doesn't have to simply wipe stuff, it can do practically anything. It could fake having a dead battery, or suffering some kind of crash or other normal annoying service interruption. It could fake a Microsoft account login problem due to some problem with the wifi or borked corporate account control etc. You could increase the believability by pretending to have very common bad security habits like having the duress password written down somewhere on your person or with the machine.
If you are a spy and they have you in a hole, then your cover is already blown. They will remove and dissect the storage without even trying to boot it. But things like this could keep you from being noticed in the first place, and could sufficiently handle the vast majority of situations.
In Russia right now, they are stopping random people on the street to look for certain telegram groups on people's phones. The randos aren't spies and aren't specifically targeted. The police are really only doing it to scare everyone else away from accepting any communication about Ukraine from outsiders.
It would be exactly perfectly good enough if they simply didn't see what they were looking for.