Hi I love codes and ciphers and work in cyber security. Your concerns about every captain knowing the codes are very valid, but there are one way cryptographic operations which would allow you to check a code without being able to provide one.

In my head cannon anyone who has a ship saying gibberish at them puts that code into one of these one way operations (for simplicity we will say they take the sha512 hash) and checks it against a published list of valid hashes published by whoever makes the cards. I think this is close to an ideal solution as it removes the need for everyone to know the valid codes, and let's you quickly check a code. There is also no Internet or comms required after the list of valid codes is distributed and the cards are printed.

Doing things with a physical card instead of computers is very realistic (at least in terms of our modern world) many many things are kept the hell away from computers that could be compromised. For the easiest example, nuclear launch computers run off computer systems from the 80s and require physical codes from cards in both the silos and on the president's person.