Let's just get this out of the way. Orthrus, at least when compared to modern SD card readers, is going to be slow.

The ATMega32U2 only supports full-speed USB, which is 12 mb/sec. That's more like at best 1 MB/sec. Compare that to a benchmark of SD cards in Raspberry Pis that start at 10 times faster.

But it's worse than that. The AVR SPI system can only be clocked at 8 MHz - half the system clock speed. Making things worse, it's not double-buffered, so there is an inter-byte gap as well. And add on top of that that every 16 bytes an AES ECB operation will need to be performed in software. I think we can count ourselves fortunate if Orthrus achieves a throughput of 100 kB/sec.

How can we do better? Well, Atmel offers the AT32UC3A464S. That's a chip with a hi-speed USB interface, built-in support for SD v2.0, and a built-in AES accelerator. The downside is that that chip is $6 in Q:4K, comes in a 100 ball BGA package, and is otherwise way, way overpowered for what we need. Even that wouldn't likely be able to operate a modern SD card at its maximum speed, but it'd be in the ballpark at least.

So you're going to want to store small things on Orthrus, like secure key material, small text files, things like that. Today's 8 or 16 GB SD cards are going to be a waste, but at least they're cheap.