systemd's "journald" does this, it's called "Sealing", and it's enabled by default. I turn it off on my stand-alone systems, it's a waste of processing on them

systemd's "journald" does this, it's called "Sealing", and it's enabled by default. I turn it off on my stand-alone systems, it's a waste of processing on them IMHO (particularly if you don't backup the sealing key)