Can you reinstall OS X on a FileVault 2-encrypted drive?

Question

I've been researching FileVault 2 to make sure that I understand it before I enable it on my Mac. While reading Macworld's Complete guide to FileVault 2 in Lion, I encountered an unexpected caveat (emphasis mine):

It's probably worth mentioning that someone who steals a FileVault-enabled Mac can never shut down or restart the machine without losing access to the booted machine's startup drive. (Although they probably wouldn't realize this until after shutting down or restarting.) This also means they can't install updates that require a restart, let the battery run down to zero, or even wipe the hard drive clean and reinstall the OS to get a "working" computer.

This doesn't make sense to me. In my mental model of FileVault 2, a tiny decryption program stored on the hard drive is loaded during the boot process. This program asks the user for the key and uses it to begin decrypting the drive and start the OS. If you were to reinstall the OS, it would overwrite the decryption program and boot normally.

Why can't you reinstall the OS on a FileVault 2-encrypted drive?

Answer 1

When you try to run the OS X installer it will refuse to install to a disk encrypted with FV2 and Disk Utility will refuse to partition or erase FV2 volumes.

That being said, if you know your cli-fu you can destroy the partitions using the Terminal app included on the installer (which I've done, although now I don't remember if I used diskutil or just brute forced it by overwriting the partition table with dd, point being that it can be done).

Answer 2

If you don't care about the data, it's pretty standard (almost doesn't quality as "cli-fu" even); from Recovery HD, you can do it all in Terminal (Utilities > Terminal)

First, do a diskutil cs list to see the CoreStorage information on the volume. Grab the longish UUID of the Logical Volume Group you want to nuke (typically near the top of the output; scroll up). Now, diskutil cs delete UUID (where UUID is the LVG's UUID). Requires no knowledge of the key or an authorized user. Just blows the volume away.

Again, if you don't care about the data. A completely legitimate example of this is a laptop my predecessor used to test FileVault 2. Didn't use an Institutional key or a local one he left where anybody could find it, and his account was the only authorized user.