I've seen speculation that if you hard brick your phone and use an unbrick image then you can downgrade to 4.1.2. I dont know enough about this to go tell anyone to do this, but it sounds like it could work. Phones come out of the factory with binary that can not be changed. Post-knox phones have knox included in this binary. Pre-knox phones do not. This makes those phones less secure maybe? Older phones like the galaxy s3 were not created with knox integrated in to the system, so there should be a way to rid them of knox.
If it can be put together, it can be taken apart.