That's what I was going to suggest as I was reading the first part of your post. Why not store the encryption key on a USB thumb drive? I believe TC already has a tutorial for that, or you can find them on the internet. Are you using dd to make a bit for bit copy? And how are you "removing" it, just zeroing it out? That's pretty advanced. I assume you'd write a script to automate switching the headers before and after use.