Put the key in the actual key (or key fob, in the case of Tesla). Service technicians could use a "valet+" key that would get them access to everything except

Put the key in the actual key (or key fob, in the case of Tesla). Service technicians could use a "valet+" key that would get them access to everything except those protected logs, or read only access to the logs. If the customer were so inclined, they could volunteer the key+key to the technicians. The key+key would be tamper resistant so that revoking credentials after getting your car serviced would be less necessary; just make sure they give you that key back.