In the United States, an authentication scheme that doesn't rely on mental contents wouldn't be subject to self-incrimination protections against compulsory decryption.