I'm pretty sure Coursera or edX was using this same approach a while back — they'd make you type in a paragraph of text, then they'd use the timing information as a fingerprint or signature, to authenticate you as the actual student.