Comment by numpad0

The word for crypto device self destruction military guys use is zeroize. It can be triggered manually or automatically. A zeroized device can be repaired and signed off by a trusted person, then a new key loaded by another person.

Maybe these devices could ship in a tamper-detection-only mode, then detection triggered by user to be inspected by the user, then factory installed firmware wiped and reloaded if desired, have user key loaded to the firmware, and the shell sealed back up with electronic and physical detection enabled.