>Surprised this wasn't implemented as whole filesystem encryption and then just overwriting the secret key in the SE instead of dealing with the time/battery co

>Surprised this wasn't implemented as whole filesystem encryption and then just overwriting the secret key in the SE instead of dealing with the time/battery cost of an incomplete wiping of "passcode-protected data." It is; it zeroizes the KEK. Nothing is slowly wiped from end to end.