That would be an extremely uncreative implementation. Positional complexity, time taken, mouse position/movement/clicks/arrows drawn, piece 'touch' instances, a

That would be an extremely uncreative implementation. Positional complexity, time taken, mouse position/movement/clicks/arrows drawn, piece 'touch' instances, and historical performance in similar positions are all things that could conceivably be easily tracked and potentially serve as legitimacy signals.