Hi, some ideas:
1) one solution for not allow the sd card from the pi is to glue the sd card to the pi, so any attempt to take the sd card out of the pi wil destroy the sd card.
2) ptython scripts source code are not need to be installed in the sd card, python do a "compilation phase" before it is run in Python byte code ( intermediate code), that make the python code more or less secure, there are always ways to "disablem" the Python byte code but there are ways to encrypt the Python byte codein the sd card and left the encrypted version in the sd card, and before it is run it can run a decryption program and write the decrypted code in a ram disk of the pi, so the Python byte codewill never be write to the sd card. Also the external pcb can contain the decrypt key, even better you can use the pi arm unique identifier as a part of the key, that can create a software version that only run in thet pi and pcb.
weaknesses:
1) Glue the sd card will not allow to change the sd card in the pi, at a $35+10+- hardware price for pi and sd card thats depend to the solution price and details if this is a valid option.
2) Create SW that only run in one pi + pcb will need a per pi instalation with some type of licence that will depend to the unique keys. Also has some implication to the project.
Best Regards,
David