I have installed a Jessie Raspbian on an Rpi, installed a Zymkey 4i (non-locked) and encrypted the rootfs.
Can I upgrade to Stretch by (dist-)upgrading Jessie then changing sources then (dist-)upgrading again?
Or do I have to reinstall everything from scratch?
What if the Zymkey was locked?
Jessie to Stretch is a big change, with lots of possibilities for blowing up, depending upon what your system environment looks like. We recommend re-installing from scratch.
Same is true if your zymkey is locked, expect that if (when) you brick it you have no recovery mechansim. You will need a new zymkey too.