
Ok, so there are in fact two distinct components transmitted by the
chip; the real message encrypted with the "conventional" key, and the
serial number and encrypted "conventional" key encrypted with the
(IMHO kind of bogus, as the whole concept of "one key that millions of
people use which can't be changed" doesn't seem reasonable) "family
key".

Suppose I analyze the output of this chip and I'm able to determine
which bits are the encrypted packet which contains the serial number
and session key.  Suppose I also design a simple algorithm based on
this information which takes the data containing the encrypted session
key and twiddles a bit (or several) before it's sent down the line.

Mind you, I'm sure the NSA thought of this along with a dozen other
attacks I can't imagine, and the system is probably somehow designed
so that manipulation of this information will cause a compliant
receiving chip to somehow fail to decrypt successfully.  But how?
What if the two parties agree in advance on some kind of consistent
bit-twiddling scheme, so the decryption chip sees the restored
"proper" bitstream but an eavesdropper gets a E[K; UK] packet that's
wrong?

I suppose this could be easily defeated if the chip "sends" that
information out many times in slightly different ways, making it
effectively impossible to be certain you know all the information
being sent.