I'm pretty sure this is trivially implementable in CHDK [1]. Already, with the hacker-enabled RAW mode (this is on Canon P&S cameras), it saves a RAW copy of the image to the SD that never shows up in the camera browser. If you delete the JPG using the camera, the RAW file is still there, but not visible to the camera.

So what you'd want to add, for safety's sake, is to make the camera save this RAW in a custom format (and folder and naming structure) that is inconspicuous, but can be read by your custom RAW software. E.g. save the RAWs in some scientific data format and say you're a student and those files are from some old class assignment you had to transfer.

I estimate it would take a dedicated hacker less than a month to put together on their spare time.

Without transmission capability, you can never guard against deletion (they could just confiscate or destroy the SD).

[1] http://chdk.wikia.com/wiki/CHDK

Simpler, store two images, one encrypted, one not. You can only review and delete the unencrypted one. Your decrypter back at home could automatically remove the deleted images so you don't have to review as much if there were no problems.

Good idea for most cases!

Concealing ALL photos will still need to be an option for some, though: plausible deniability of "did you take pictures of X" when questioned :)

IIRC some "wifi" SD cards run some form of linux, so it might be possible to hack in some encryption.