The CryptoNote whitepaper contains this example of application for the transaction script system (in §6.3):
Password protection. Possession of a secret password s is equivalent to the knowledge of a private key, deterministically derived from the password: k = KDF(s). Hence, a receiver can prove that he knows the password by providing another signature under the key k. The sender simply adds the corresponding public key to his own output. Note that this method is much more secure than the "transaction puzzle" used in Bitcoin, where the password is explicitly passed in the inputs.
Is it possible to do that with Monero?
What are some realistic use cases for that?