I think this might backfire, though.

It's the same problem with Veracrypt/LUKS hidden volumes. If they know about the sandbox capability, they could easily say "okay, now unlock the real one" if they find nothing incriminating. What happens if you _did_ unlock the real volume/sandbox in the first place and have nothing incriminating on it?

Only remedy for this is having arbitrarily many sandboxes.