On the other hand, he's been to both Hong Kong and China now. Government officials from either country may be among those people with the encrypted data. Whether or not they release the encrypted data when/if the key is publicized doesn't really matter.

Publicly distributing the encrypted data does seem to be better to me, but making it ambiguous as to whether or not foreign governments have it seems like it could be a decent second best.