I was realizing that I may have been thinking about this wrong. Perhaps instead of having a single point of success or failure (the "login"), the system should constantly be authenticating you and verifying your identity, and start limiting you if you fall short of the authentication. It looks like a few companies are working on that under the purview of "behavioral biometrics" or "active authentication". You could imagine that the system is constantly challenging you and learning and recording your behavior based on these challenges, and that, the longer you use the system, the better it gets to know you and better recognize intruders.