Actually, after re-reading your scheme it doesn't sound too bad either... the main problem would seem to be then if the encryption was fundamentally broken (ie:

Actually, after re-reading your scheme it doesn't sound too bad either... the main problem would seem to be then if the encryption was fundamentally broken (ie: if the encrypted bits are recoverable after the second factory reset and could then be decrypted)