I built a redaction process for a small company once.
My critical security step was rendering out the PDF as individual flat image files, then re-assembling it like a traditionally photo-copied document.
That way the loss-full operation is enforced, at the cost of forcing end users to OCR unsearchable image-scan (like) PDFs.