Hardware security. These devices should have been built from day 1 with the idea that they would eventually need to be retired from service. They could be designed to self-destruct their own memories if a certain signal is not received within a certain timeframe. Procedures would be built around this such that cameras would need to be periodically checked-in for audit and refresh of the hardware kill timer. If an officer fails to check in a certain camera (presumably with the intent to expire the hardware timer), you could assume malicious intent and have whatever arbitrary penalties to discourage this behavior. Set the timer at 48~72 hours and it would be virtually impossible for even the most sophisticated attacker to physically breach the HSM in time for extraction of the data/symmetric key.

Combine this with a PKI and you should then have a solid solution. If you want maximum traceability, you could throw in LTE or satellite connectivity for logging major audit events or triggering certain device features remotely.