Well, with the remaining trust available at this point you might just as well use something cryptographically secure, like encrypted ones, twos, or simple HMACs of the block number.
A too-simple scheme is likely to be detected (and bypassed!) by the firmware a nearly no time.
though I wouldn't expect this exact command sequence to work unless tee's buffer size divides /dev/DEVICE's capacity and tee errors out writing past the end of /dev/DEVICE before writing to stdout.
A too-simple scheme is likely to be detected (and bypassed!) by the firmware a nearly no time.