I don't know all the methods used by WPScan but here is a function that I use to remove some data about the version. Perhaps in conjunction with your other methods it might be a solution.
// remove version info from head and feeds
function generator_version_removal() {
return '';
}
add_filter('the_generator', 'generator_version_removal');
As was noted in the comments that most attackers won't bother checking, I think this is true. However, for those few who do check, I assume their attack is more sophisticated and you don't want to be caught among the fruit that hanging just low enough to grasp.
As was also noted in the comments, WPScan apparently checks multiple fingerprints and this covers just one. Hopefully, it might be the one you are missing. Perhaps it is just one of many.
My experience with WPScan is limited, but perhaps you can get a more verbose output.
Hope this helps a bit, it is only part of what you are looking for though.
ADDITION: Emoji Update.
There was an Emoji update with version 4.2 (I believe 4.2) that was part of a big security update. I can't seem to find the post about it right now, but I remember something about a security hole that had been around for a while and was finally fixed via some clever use of Emoji. When the update came through and there was so much emphasis about Emoji people wondered why and so it was explained that it was something of a cover for the security update. Long story short: WP 4.2+ has an Emoji update that will let WPScan (and others) know that you are running at least that version.
ADDITION: (2016-07-15) Another plugin I have been using but its main purpose is for speed is called Remove Query Strings From Static Resources. I hadn't remembered this plugin at first but since the default query string appended to JS files is the WordPress version number when no other version is given. With that as the query string for multiple files it would be a dead giveaway to see what WP version you have.