But does that make them different or are they just things that are easy to verify? If you could calculate the entropy of another authentication scheme would it be included?

The danger of security by obscurity is that your system might not have as much entropy as you initially estimate and can be easily defeated. Sounds a lot like the vulnerabilities in normal crypo applications, right?