>I was under the impression that you couldn't run a bruteforcer against these phones because the key is kept inside of a hardware security module. Couldn't the duress code just wipe the key in the HSM?

That's something I hadn't considered. Is it set up that you can create and destroy the keys but never get access to them?