Is it possible to require a set of authentications.For example allow login if pam_usb and pam_thinkfinger succeed or unix password? That would require you to have the usb key AND your finger (no password needed), if you don't have both you only need your password. I have searched around and It looks like there was a pam_if at one point and some talk about different ways to implement something similar to this. I just can not seem to find if it has been done.
I suppose you could put the one with the single requirement first, with a "sufficient" and then put the other two as "required" below it. There may be a better answer .. that's my first thought.
HTH, Barry