I like the approach of having an undefined amount of passwords. TrueCrypt is flawed because it lets you have at most two passwords. For an oppressive enough go

I like the approach of having an undefined amount of passwords. TrueCrypt is flawed because it lets you have at most two passwords. For an oppressive enough government, it seems quite the good way to expect one have two passwords (or else, he would probably not use TrueCrypt) and to torture him until those two passwords are obtained. Not knowing how many passwords are used give a better chance. The detained person will still have to accept torture for a while instead of giving all fake passwords right away for it to be believable, though...