How to do backups and updates properly with full device encryption?

I think about the following use cases:

• 'Perfectly' reverse encryption without losing settings


• Update ROMs. Even if /system, /data, /sdcard (internal) are encrypted


• Low level Backups with CWM. When SDCARD partition is also encrypted.


• Emergency access to my data (screen broken, soft bricked...)



• How to mount crypted dumps on linux (knowing the passphrase)

Is there some salt value going into the key together with the passphrase stored on the device?

I currently use a tmpfs mount to /sdcard and 'adb push update.zip' on my Nexus S to update the ROM. I've been told that the Galaxy Nexus also has an encrypted /system which would prevent all that (see Nexus S solution here: Broken screen while debug mode was disabled. How can I re-enable adb? )