Yeah, for this scheme to work, a locked phone would need to be a brick, short of desoldering the flash. Unauthenticated recovery modes destroy this. I can see

Yeah, for this scheme to work, a locked phone would need to be a brick, short of desoldering the flash. Unauthenticated recovery modes destroy this. I can see a scheme where each device has a specific unlock/recovery keypair in its keychain out of the factory (or first activation). It could be requested from the manufacturer from the service center. This would at least have accountability ("AT&T Store #451, Employee #8 requested unlock key for Device #123456"). The manufacturer's service could deny the request if the phone was reported stolen, or contact the rightful owner via other channels before releasing it. Or just revoke access to service centers with a history of abuse (e.g., the thieves have an "guy" at a strip mall).