As per login.conf(5), all local authentication style names should
start with a dash `-`.

When a password is to be verified, first read /etc/duress and find
the user's entry. If the password matches the password in the
duress file, then the command is stored for later.

After trying to authenticate against the user's system password (to
keep timing the same each attempt), if the duress command is
available, it is run as the user as a forked-off process and
login_duress returns successful authentication to the caller.