[acdha]

The authors are claiming that it helps against duress but the system as described only does so in the most limited theoretical scenario where the attacker and defender both have significant, contrived restrictions. There's a reason why you remember those retina scanner tricks from movies: in the real world, security is about protocols and those tricks would fail in any realistic scenario short of, say, aliens with body-sculpting nanobots.

As a trivial example: this system assumes a single attempt in a guarded facility. What benefit does this offer over a duress password which our poor hostage provides knowing that it will trigger a full security response and locking out of their access? For that matter, why not have the same guard who looks for tricks check your face against the employee database?