Change encryption key before flashing
We currently mark the encrypted images as "for evalution only" and expect users to ensure changing keys on their own but it would be better to do that out of the box:
For encrypted images we should change the encryption key similar to
kpartx -a librem5r4.img # time cryptsetup-reencrypt /dev/mapper/loop0p2
# cryptsetup luksDump --dump-master-key /dev/mapper/loop1p2
shows that is actually changed.