What good will onboard encryption be if the device is seized? They will just figure out how to decrypt. I guess you’d need to set up asynchronous encrypt / decrypt keys, then move the data encrypted end to end. The target device can do the decrypting, while the bug only does encrypting.