Aren't the only PALs on a US SSBN the launch keys? I realize that the devices themselves have anti-tamper PAL components, but once the safe is opened and the keys are out I was under the impression that the captain and xo could launch without any additional outside input. Happy to be wrong, but to the best of my (very limited) knowledge there is no need for an external authentication code to launch a sub nuke.
There's a code lock - the PAL - on US Tridents, not just the launch keys. Anecdotally and non-authoritatively I've heard that there are offline backup codes in a safe accessible to the command crew (which is the mechanism I refer to above).
"Last strike" is arguably a necessary component of a submarine deterrent since it means even a surprise decapitation strike carries the risk of a retaliation. It's certainly why the UK delegates launch authority to the captain (again, after a procedural verification of the destruction of the chain of command).
