Actually the solution is to store the secure-boot key and the full-disk-encryption key in the same place, and design the hardware so that erasing the former als

Actually the solution is to store the secure-boot key and the full-disk-encryption key in the same place, and design the hardware so that erasing the former also erases the latter. You don't need any one-time anything.