Ok just unload the filevault key from ram, better? And if possible tell the secure enclave to revert to the before-first-unlock state