best practice is always to encrypt with luks, and then just shred the header before selling.

blkdiscard is just a TRIM command, the data remains there.

A few years ago (2020?) I also learned that ssd firmware can be buggy when I bricked multiple really expensive enterprise ssd (samsung?)....by running trim. lol.

But how do you shred the header? The drive could have written the new shredded one to a new physical location (wear-leveling).